Company: PHR
Filing Date: 2025-05-28
Form Type: 10-Q
Source: 0001412408-25-000039
Chunk: 33

Company: Phreesia, Inc.
Filing Date: 2025-05-28
Form: 10-Q
Item: Part II, Item 1A
Chunk 33
---
 risk. Connecticut and Nevada have also passed similar laws regulating consumer health data, and New York’s Health Information Privacy Act is awaiting the governor’s signature. The effects of state and federal privacy laws are potentially significant and may require us to modify our data processing practices and policies and to incur substantial costs and potential liability in an effort to comply with such legislation.

We cannot yet determine the full impact these laws or other such future laws, regulations and standards may have on our current or future business. Any of these laws may broaden their scope in the future, and similar laws have been proposed on both a federal level and in various states in the U.S. Such proposed legislation, if enacted, may add additional complexity, variation in requirements, restrictions and potential legal risk, require additional investment of resources in compliance programs, impact strategies and the availability of previously useful data and could result in increased compliance costs and/or changes in business practices and policies. The existence of comprehensive privacy laws in different states in the country, and the heightened scrutiny associated with the enforcement of such laws, could make our compliance obligations more complex and costly and may increase the likelihood that we may be subject to enforcement actions or otherwise incur liability for noncompliance. State laws are changing rapidly and there are discussions in the U.S. Congress of new comprehensive federal data privacy laws to which we could become subject, if enacted.

While we primarily process data of consumers located within the United States, we process data of consumers located in other jurisdictions and have employees outside of the United States that may be subject to foreign laws. Internationally, virtually every jurisdiction in which we operate has established its own data security and privacy legal 

60

Table of Contents

framework with which we or our customers must comply. Cross-border data transfers and other future developments regarding local data residency and access could increase the cost and complexity of delivering our services in some markets and may lead to governmental enforcement actions, litigation, fines and penalties or adverse publicity, which could adversely affect our business and financial position could greatly increase our cost of providing our products and services, require significant changes to our operations or even prevent us from offering certain services in specific jurisdictions. In addition, any limitation on our ability to use or transmit health information outside of the U.S. could impose restrictions on our ability to recruit and maintain employees residing outside of the U.S., which could, in turn, adversely affect our business.

We expect that there will continue to be new or amended laws, regulations, standards and obligations proposed and enacted in various foreign jurisdictions. Many countries around the world have enacted