Company: VEEV
Filing Date: 2025-11-21
Form Type: 10-Q
Source: 0001393052-25-000078
Chunk: 231

Company: VEEVA SYSTEMS INC
Filing Date: 2025-11-21
Form: 10-Q
Item: Part I, Item 8
Chunk 231
---
 My Health My Data Act, which became effective on March 21, 2024, establishing significant new restrictions on how businesses can collect, use, and disclose consumer health data. Veeva Crossix’s data platform combines large-scale data sets, inclusive of de-identified health and consumer data, to provide insights, analytics, and audience segmentation for our life sciences customers in the U.S. In response to the Washington law, we made modifications to our audience segments that may reduce demand for our Crossix products, which, in turn, could adversely impact the business. Other states have considered, and in certain cases enacted, similar laws. Additionally, the U.S. Department of Justice recently issued a final rule that places limitations, and in some cases prohibitions, on certain transfers of and access to certain personal data of U.S. persons by persons and entities located in China (and other designated countries) or controlled by a person or entity located in China (and other designated countries). These various laws, regulations, and legislative developments have potentially far-reaching consequences and have and may continue to require us to modify our solutions, our global support business, and our data management practices and incur substantial expense in order to comply.

In addition to governmental laws and regulations, privacy advocates and other key industry players have, and may continue to, establish various new standards and certifications, such as the prohibition of third-party cookies and other identifiers in certain digital environments, that may place additional burdens or resource constraints on us, limit our ability to collect, use, and otherwise process certain data, and limit our ability to generate certain analytics. Our customers may expect us to meet voluntary certifications or adhere to other standards established by third parties. Understanding and implementing industry and customer specific requirements and certifications on top of our internationally recognized security certifications could require additional investment and management attention and may subject us to significant liabilities if we are unable to comply. Moreover, the continuing evolution of these standards might cause confusion for our customers and may have an impact on the solutions we offer. If we are unable to maintain these certifications or meet these standards, it could reduce demand for our solutions and adversely affect our business and operating results.

Customers expect that our solutions can be used in compliance with applicable data protection, data privacy and cybersecurity laws and regulations. Compliance with these global laws and regulations, including any new or evolving regulations relating to the use of data in AI and machine learning technologies, such as the EU AI Act, has and will continue to require valuable management and employee time and resources and modification of our products or operations,