ACRUX LIMITED — Governance Information 2021

Dec 16, 2021

ACRUX LIMITED

WHISTLEBLOWER POLICY

==> picture [531 x 77] intentionally omitted <==

==> picture [39 x 27] intentionally omitted <==

WHISTLEBLOWER POLICY

1. OVERVIEW OF THE POLICY

The Directors and management of Acrux Limited and its related bodies corporate (the ‘Company’) are committed to maintaining good standards in corporate governance, ethics and behaviour in all of the Company’s activities, including the Company’s interaction with its shareholders, current and former employees, business partners, customers, suppliers, the community and the environment in which the Company operates.

The Company recognises its responsibilities as a developer of pharmaceutical products and that it must conduct its business in accordance with the law, and with locally and internationally accepted practices and procedures.

All employees of the Company play an important role in establishing, maintaining and enhancing the reputation of the Company by ensuring observance of the high standards of ethics and behaviour to which the Company is committed. The Company requires that its employees display the highest levels of professionalism in all aspects of their work to facilitate the Company’s compliance with its Code of Conduct and all applicable laws.

As part of this the Company is also committed to maintaining a culture where those involved with our business are encouraged to raise concerns about any misconduct or any improper state of affairs of which they become aware, and can do so safely. A whistleblowing program is an important aspect of detecting poor or unacceptable practice and misconduct in an organisation.

This Policy should be read in conjunction with the Company’s Statement of Corporate Governance Principles and Code of Conduct which can be found on the Company’s website (www.acrux.com.au) in the corporate governance section under the headings ‘Statement of Corporate Governance Principles’ and ‘Code of Conduct’. This Policy prevails to the extent of any inconsistency between it and the Code of Conduct or Statement of Corporate Governance Principles.

2. INTERPRETATION, OBJECTIVES AND PURPOSES

2.1 Purpose

The purpose of this Policy is to encourage those involved with our business to raise their concerns if they become aware of any misconduct or any improper state of affairs.

This policy explains the protections available to those who raise concerns and when those protections will apply, and outlines the support that will be provided to those that raise their concerns.

2.2 Interpretation

In this Policy:

• ASIC means the Australian Securities and Investments Commission;

• Company means Acrux Limited and its related bodies corporate;

• Corporations Act means the Corporations Act 2001 (Cth);

• Protected Disclosure means a disclosure that benefits from the protections set out in the Whistleblower Protection Laws and this policy, and includes disclosures made in relation to those matters set out at paragraph 4.1 of this Policy, together with public interest disclosures and emergency disclosures, as defined in the Corporations Act;

• tax affairs mean affairs relating to any tax imposed by or under, or assessed or collected under, a law administered by the Commissioner of Taxation; and

• Whistleblower Protection Laws includes the Corporations Act and Taxation Administration Act 1953 (Cth).

Page 2 of 8

==> picture [39 x 27] intentionally omitted <==

2.3 Benefits of this policy

An effective whistleblowing program can result in:

• (a) more effective compliance with Whistleblower Protection Laws;

• (b) a healthier and safer work environment;

• (c) more effective management;

• (d) improved morale;

• (e) more efficient fiscal management of the Company; and

• (f) an enhanced perception and the reality that the Company is taking its governance obligations seriously.

3. WHO CAN MAKE A PROTECTED DISCLOSURE?

• Any person who holds, or has held any one of the following positions can make a Protected Disclosure: • an officer of the Company;

• an employee of the Company;

• a secondee or volunteer of the Company;

• a person who supplies goods or services to the Company, or an employee (or former employee) of such a supplier;

• an associate of the Company, within the meaning of the Corporations Act; or

• a relative or dependent of any of the persons referred to above.

Each such person making a protected disclosure under this Policy is referred to in this Policy as the ‘ Whistleblower ’.

4. WHAT MATTERS CAN BE INCLUDED IN A PROTECTED DISCLOSURE?

4.1 Disclosures that are protected by this Policy and the Whistleblower Protection Laws

A disclosure will qualify as a Protected Disclosure, if it is made by a Whistleblower who has reasonable grounds to suspect that the information disclosed concerns misconduct , or an improper state of affairs or circumstances in relation to the Company or one of its related body corporates. The matters that may be included in a Protected Disclosure are broad, and may include (but are not limited to):

• Misconduct in relation to the Company, including fraud, negligence, default, breach of trust, breach of duty, unethical conduct and systemic or serious breaches of the Company’s Code of Conduct or Corporate Governance Principles.

• Breach of the Corporations Act or other laws administered by ASIC by the Company, its officers or employees. Such conduct includes victimising a person who has, or is thought to have made a Protected Disclosure.

• Breach of any other Commonwealth laws, punishable by 12 months or more imprisonment by the Company, its officers, or employees.

• Conduct by the Company, its officers or employees that represents a danger to the public or to the financial system.

• Misconduct or an improper state of affairs or circumstances in relation to the tax affairs of the Company or an associate of the Company (as defined in the Income Tax Assessment Act 1936 ).

• Any attempt to conceal or delay disclosure of any of the aforementioned conduct.

4.2 Disclosures that are not protected by this Policy and the Whistleblower Protection Laws

Disclosures about other matters will not be Protected Disclosures and will not qualify for protection under the Corporations Act. Complaints regarding service levels, Policy decisions, or other work-related grievances with people in the Company are not Protected Disclosures and are instead dealt with through the employee grievance procedure outlined in the Company’s Human Resources Manual.

A personal work-related grievance may still qualify for protection if:

• it includes information about misconduct, or information about misconduct includes or is accompanied by a personal work-related grievance (mixed report);

• the relevant entity has breached employment or other laws punishable by imprisonment for a period of 12 months or more, engaged in conduct that represents a danger to the public, or the disclosure relates to information that suggests misconduct beyond the Whistleblower’s personal circumstances;

Page 3 of 8

==> picture [39 x 27] intentionally omitted <==

• the Whistleblower suffers from or is threatened with detriment for making a disclosure; or

• the Whistleblower seeks legal advice or legal representation about the operation of the whistleblower protections under the Corporations Act.

Deliberate false reports are not Protected Disclosures and are strongly discouraged.

5. PROCEDURE FOR MAKING AND INVESTIGATING PROTECTED DISCLOSURES

5.1 Whistleblower Protection Officer

The Company will appoint an appropriately qualified and suitable senior employee to the position of Whistleblower Protection Officer. The Whistleblower Protection Officer may be contacted on wpo@acrux.com.au.

The role of the Whistleblower Protection Officer is to safeguard the interests of a Whistleblower in terms of this Policy, the other policies of the Company and any applicable legislation.

The Whistleblower Protection Officer has direct, unfettered access to independent financial, legal and operational advice as required for the purposes of effectively carrying out the role.

5.2 Whistleblower Investigations Officer

The Company will appoint an appropriately qualified and suitable senior employee to the position of Whistleblower Investigations Officer. The Whistleblower Investigations Officer may be contacted on wio@acrux.com.au.

The role of the Whistleblower Investigations Officer is to investigate any disclosures to determine whether the disclosure is a Protected Disclosure, and to determine whether there is evidence in support of the reported conduct.

The Whistleblower Investigations Officer has direct, unfettered access to independent financial, legal and operational advice as required for the purposes of effectively carrying out the role.

The Whistleblower Investigations Officer will not be the same person as the Whistleblower Protection Officer.

5.3 Reporting

A Whistleblower may make a Protected Disclosure to the Whistleblower Protection Officer. The Company recommends that this be done in person or in writing marked ‘Confidential’.

If for any reason it is not appropriate to report to the Whistleblower Protection Officer, the Whistleblower may also make a Protected Disclosure by contacting:

• another officer or senior manager of the Company, including the Chief Executive Officer or Managing Director of the Company; or

• an auditor or a member of an audit team conducting an audit of the Company.

If the Protected Disclosure relates to improper conduct in the Company’s tax affairs, internal disclosures may also be made to:

• an officer or senior manager of the Company;

• any other employee or officer who has functions or duties relating to the tax affairs of the Company; or

• a registered tax agent providing tax agent services to the Company.

These persons are eligible recipients for Protected Disclosures and their roles include receiving disclosures that qualify as Protected Disclosures.

Page 4 of 8

==> picture [39 x 27] intentionally omitted <==

The Whistleblower Protection Officer, or other eligible recipient to whom the Protected Disclosure is made, may ask the Whistleblower how they think the matter might best be resolved. If the Whistleblower has any personal interest in the matter, it is essential that this is made known to the Whistleblower Protection Officer, or other eligible recipient, at the outset.

The Whistleblower making a Protected Disclosure will not be expected to produce irrefutable evidence to support the concerns raised. All that is required is that the Whistleblower has reasonable grounds to suspect the existence of the misconduct , or an improper state of affairs that is the subject of the Protected Disclosure. It is in the Company’s interests to hear of suspicions of any potential misconduct or improper state of affairs at the earliest possible opportunity. A Whistleblower can still qualify for protection as a whistleblower under the Corporations Act even if their disclosure turns out to be incorrect.

Whistleblowers will also qualify for protection as whistleblowers under the Corporations Act if they make external disclosures about the matters set out in section 4.1 of this policy to:

• ASIC or another Commonwealth body prescribed by regulation;

• A legal representative for the purpose of obtaining legal advice or legal representation about the operation of the whistleblower provisions in the Corporations Act (even in the event that the legal practitioner concludes that a disclosure does not qualify for protection under the Corporations Act); or

• A journalist or a parliamentarian, in each case in limited circumstances described as either an “emergency disclosure” or “public interest disclosure” in the Corporations Act.

It is important for a Whistleblower who intends to make an “emergency disclosure” or a “public interest disclosure” to a journalist or a parliamentarian to first understand the criteria for such disclosures that are set out in the Corporations Act. In order to qualify, a disclosure must first have been made to ASIC or a prescribed body, and written notice provided to the body to which disclosure was made. In the case of public interest disclosure, at least 90 days must have passed since the previous disclosure. Whistleblowers should contact an independent legal adviser before making a public interest disclosure or an emergency disclosure.

5.4 Investigation

The key steps that will be taken following the receipt of a disclosure are: (1) assessment; and (2) investigation of the disclosure.

Firstly, the disclosure will be assessed by the Whistleblower Protection Officer to determine:

• Whether it qualifies as a Protected Disclosure; and

• Whether a formal, in depth disclosure is required.

This first “assessment” phase will ordinarily be completed within 5 working days of disclosure, however the time frame may vary depending on the nature of the disclosure.

Secondly, if the disclosure is considered by the Whistleblower Protection Officer to be a protected disclosure, the disclosure will be thoroughly investigated by the Whistleblower Investigations Officer. The Whistleblower Investigations Officer will endeavor to:

• investigate the Protected Disclosure within a reasonable period of time;

• follow thorough, objective, independent and fair investigation procedures and, where possible, protect the privacy of employees who are mentioned in a Protected Disclosure;

• avoid conflicts of interest in carrying out the investigation;

• keep information relating to Protected Disclosures (including the identity of the Whistleblower) confidential, except as permitted or required by law or permitted under this Policy; and

• where appropriate to do so, and if the Whistleblower can be contacted, provide the Whistleblower with regular updates. The frequency and timeframes of any updates will depend on the nature of the disclosure.

Page 5 of 8

==> picture [39 x 27] intentionally omitted <==

This second investigation phase will ordinarily be completed within 10 working days of the disclosure having been assessed by the Whistleblowing Protection Officer as a Protected Disclosure, however the time frame may vary depending on the nature of the disclosure.

5.5 Outcome

Following completion of their investigation, it is the obligation of the Whistleblower Investigations Officer to ensure that:

• all Protected Disclosures are dealt with appropriately; and

• the disclosure is recorded in such a way as to ensure that systemic or recurring matters are identified and reported to those with sufficient authority to correct them.

5.6 Feedback

The Company will ensure that the Whistleblower is promptly informed of the outcome of the investigation of their Protected Disclosure, subject to considerations of privacy of those against whom allegations have been made and the customary confidentiality practices of the Company.

5.7 Reporting to Chief Executive Officer

Both the Whistleblower Protection Officer and the Whistleblower Investigations Officer have a direct line of reporting to the Chief Executive Officer and Managing Director. If the Protected Disclosure does or may relate to the Chief Executive Officer and Managing Director, or if the Chief Executive Officer and Managing Director has a close relationship with the person who is the subject of the Protected Disclosure, then the Whistleblower Protection Officer and the Whistleblower Investigations Officer have a direct line of reporting to the Chair of the Audit and Risk Committee of the Company.

5.8 Additional Information from the Whistleblowing Protection Officer

Before making a Protected Disclosure, any Whistleblower can contact the Whistleblower Protection Officer for additional information from the Whistleblowing Protection Officer about the protections provided to whistleblowers under this policy and the Corporations Act.

6. HOW WHISTLEBLOWERS ARE PROTECTED

6.1 Anonymity

Protected Disclosures may be submitted anonymously, and anonymous disclosures will be investigated. Whistleblowers can choose to remain anonymous while making a disclosure, over the course of the investigation and after the investigation is finalized. However, it will be more difficult for the Whistleblower Investigations Officer, or other eligible recipient, to look into the matter and report. Whistleblowers are therefore encouraged to put their name to Protected Disclosures and assist the Whistleblower Investigations Officer, Whistleblower Protection Officer or other eligible recipient as much as they can. Where a Whistleblower chooses to remain anonymous, it is suggested that the Whistleblower maintains ongoing two way communication to allow for follow up questions and feedback.

6.2 Protection of Identity

The Company is legally obliged to keep confidential the identity, and any information likely to reveal the identity, of a Whistleblower who makes a Protected Disclosure, except where:

• the Whistleblower has consented in writing to the disclosure of this information;

• the disclosure is to ASIC or a member of the Australian Federal Police;

• the Company is required to disclose this information to a legal practitioner for the purpose of obtaining legal advice or representation; or

• the Company is required or permitted to disclose the information by law or regulations.

The Company may disclose any information contained in the disclosure with or without the Whistleblowers consent:

• other than identifying information about the Whistleblower;

• where all reasonable steps have been taken to reduce the risk that the Whistleblower will be identified from the information; and

• where it is reasonably necessary for the purposes of investigating the Protected Disclosure.

Page 6 of 8

==> picture [39 x 27] intentionally omitted <==

The Company will take reasonable steps to reduce the Whistleblower’s risk of identification, including by permitting a paid leave of absence during any investigation if it is not possible to maintain the Whistleblower’s anonymity.

It is illegal for any person to identify a Whistleblower, or to disclose information that is likely to lead to the identification of a Whistleblower, outside of the exceptions outlined above. Any person who directly or indirectly receives information regarding the identity of a Whistleblower must keep that information confidential, except for the circumstances outlined above. If the person fails to do so, they may be subject to disciplinary or other corrective action by the Company. The person may also be exposed to criminal and civil penalties.

Whistleblowers can lodge complaints about breaches of confidentiality with the Whistleblowing Protection Officer or relevant regulator for investigation.

6.3 Prohibition of victimization

The Whistleblower Protection Laws prohibit victimisation or threats of victimisation of a person who has made or may make a Protected Disclosure. Any person breaching this prohibition may be ordered by a competent court to give an apology, pay compensation to the person who was victimized or threatened, or pay substantial fines and/or be imprisoned. The Company itself may also face substantial penalties.

The Company recognises that a Whistleblower usually only decides to express a concern after a great deal of thought and is committed to protecting its people from being victimized or threatened as a result of making Protected Disclosures. It does not matter whether the suspicion proves to be unfounded or real. The Company will protect the Whistleblower who makes a Protected Disclosure and will not tolerate the harassment or victimisation of, or discrimination against, such a Whistleblower or their family, relatives or colleagues. The Company will deal with any such harassment, victimisation or discrimination perpetrated by employees of the Company under the disciplinary and/or harassment procedures of the Company. Any victimisation caused by non-employees of the Company may be dealt with by other corrective action.

If a Whistleblower feels they have been victimised as a result of reporting Disclosable Matters, they should report this to their HR Manager or the Whistleblower Protection Officer.

Examples of victimisation include:

• dismissal of an employee;

• injury of an employee in his or her employment;

• alteration of an employee’s position or duties to his or her disadvantage;

• discrimination between an employee and other employees of the same employer;

• harassment or intimidation of a person;

• harm or injury to a person, including psychological harm;

• damage to a person’s property;

• damage to a person’s reputation;

• damage to a person’s business or financial position; or

• any other damage to a person.

The following actions will not amount to victimisation:

• administrative action that is reasonable for the purpose of protecting a discloser from detriment (e.g. moving a discloser who has made a disclosure about their immediate work area to another office to prevent them from detriment); and

• managing a discloser’s unsatisfactory work performance, if the action is in line with the entity’s performance management framework.

Page 7 of 8

==> picture [39 x 27] intentionally omitted <==

A Whistleblower or any other employee or person can seek compensation and other remedies through the courts if:

• they suffer loss, damage or injury because of a disclosure; and

• the entity failed to take reasonable precautions and exercise due diligence to prevent the detrimental conduct.

In such cases Whistleblowers are encouraged to seek independent legal advice.

6.4 Other protections at Law

The Whistleblower Protection Laws provide that:

• A person cannot be subject to any civil, criminal or administrative liability, for making a Protected Disclosure.

• No contractual or other remedy may be enforced, and no contractual or other right may be exercised against a person for making a Protected Disclosure.

• If the protected disclosure is to ASIC or the Commissioner of Taxation, or is a public interest disclosure or emergency disclosure as permitted under the Corporations Act, the information is not admissible in evidence against the person who made the Protected Disclosure in criminal proceedings, or in proceedings for the imposition of a penalty, except for proceedings in respect of providing false information.

These protections do not include immunity for any misconduct a Whistleblower has engaged in that is revealed in their disclosure.

6.5 Internal support for Whistleblowers

Employee Whistleblowers may be entitled to additional support from the Company, and are encouraged to explore appropriate options such as taking leave, relocation, or secondment arrangements with their HR Manager or the Whistleblower Protection Officer while a Protected Disclosure is being investigated.

If a Whistleblower is unsatisfied with the way in which their Protected Disclosure has been dealt with, they may raise this concern with CEO/Managing Director, or, where appropriate, report this as a new concern under this Policy.

6.6 Failure to comply with this Policy

Any breach of this Policy will be regarded as serious misconduct and, in the case of employees of the Company, the non-compliant person may face disciplinary action from the Company.

7. MAINTENANCE OF POLICY

• 7.1 Training

The Company will implement an ongoing program to make all its employees aware of the Company’s Code of Conduct, this Policy and its implementation.

7.2 Review and Reports

The Policy is to be reviewed annually and approved by the Board to ensure it reflects changes in law or ASX guidance, that it continues to operate effectively and whether any changes are required. The senior management of the Company will report on this Policy to the Company’s Audit and Risk Committee at regular intervals.

8. ACCESS TO THE POLICY

This Policy will be available for viewing by any person on the Company’s website.

Questions about this Policy and its application by employees should be directed to their direct supervisor or the Whistleblowing Protection Officer.

Questions about this Policy and its application by shareholders and members of the public should be directed to the Company Secretary or the Whistleblowing Protection Officer.

Page 8 of 8