Company: PHR
Filing Date: 2025-05-28
Form Type: 10-Q
Source: 0001412408-25-000039
Chunk: 197

Company: Phreesia, Inc.
Filing Date: 2025-05-28
Form: 10-Q
Item: Part I, Item 8
Chunk 197
---
 more complex and costly and may increase the likelihood that we may be subject to enforcement actions or otherwise incur liability for noncompliance. State laws are changing rapidly and there are discussions in the U.S. Congress of new comprehensive federal data privacy laws to which we could become subject, if enacted.

While we primarily process data of consumers located within the United States, we process data of consumers located in other jurisdictions and have employees outside of the United States that may be subject to foreign laws. Internationally, virtually every jurisdiction in which we operate has established its own data security and privacy legal 

60

Table of Contents

framework with which we or our customers must comply. Cross-border data transfers and other future developments regarding local data residency and access could increase the cost and complexity of delivering our services in some markets and may lead to governmental enforcement actions, litigation, fines and penalties or adverse publicity, which could adversely affect our business and financial position could greatly increase our cost of providing our products and services, require significant changes to our operations or even prevent us from offering certain services in specific jurisdictions. In addition, any limitation on our ability to use or transmit health information outside of the U.S. could impose restrictions on our ability to recruit and maintain employees residing outside of the U.S., which could, in turn, adversely affect our business.

We expect that there will continue to be new or amended laws, regulations, standards and obligations proposed and enacted in various foreign jurisdictions. Many countries around the world have enacted comprehensive privacy and data protection laws that can impact our business. Some of the businesses we have acquired are subject to additional laws and regulations in jurisdictions outside of the United States, for example, the EU, in May 2018, adopted the General Data Protection Regulation, or EU GDPR, and the EU GDPR was incorporated into the laws of the United Kingdom (“UK GDPR”, together with the EU GDPR, “GDPR”). The GDPR in the EU and the UK, which have been incorporated into their respective laws, impose stringent requirements on the processing of health and other sensitive data. These requirements encompass: (i) providing information to individuals regarding data processing activities; (ii) ensuring a legal basis or condition applies to the processing of personal data and, where applicable, obtaining consent from individuals to whom the data processing relates; (iii) responding to data subject requests; (iv) imposing requirements to notify the competent national data protection authorities and data subjects of personal data breaches; (v) implementing safeguards in connection with the security and confidentiality of the personal data; (vi) accountability requirements