Company: PHR
Filing Date: 2025-05-28
Form Type: 10-Q
Source: 0001412408-25-000039
Chunk: 409

Company: Phreesia, Inc.
Filing Date: 2025-05-28
Form: 10-Q
Item: Part I, Item 4
Chunk 409
---
 projects. Any failure or perceived failure by us to comply with domestic or foreign laws or regulations, industry standards or other legal obligations, or any actual or suspected privacy or security incident, whether or not 

61

Table of Contents

resulting in unauthorized access to, or acquisition, release or transfer of personally identifiable information or other data, may result in governmental enforcement actions and prosecutions, private litigation, fines and penalties or adverse publicity and could cause our clients to lose trust in us, which could have an adverse effect on our reputation and business. We may be unable to make such changes and modifications in a commercially reasonable manner or at all, and our ability to develop new products and features could be limited. Any of these developments could harm our business, financial condition and results of operations. Privacy and data security concerns, whether valid or not valid, may inhibit retention of services by existing clients or adoption of our services by new clients.

Existing laws regulate our ability to engage in direct marketing, and changes in privacy laws could adversely affect our ability to market our products effectively and could impact our results from operations or result in costs and fines.

We rely on a variety of direct marketing techniques, including email marketing. These activities are regulated by legislation such as the Controlling the Assault of Non-Solicited Pornography and Marketing Act of 2003 (“CAN-SPAM Act”). Any failure by us to comply fully with the CAN-SPAM Act may leave us subject to substantial fines and penalties. In addition, any future restrictions in laws such as the CAN-SPAM Act, and various United States state laws, or new federal laws regarding marketing and solicitation or international data protection laws that govern these activities could adversely affect the continuing effectiveness of our marketing efforts and could force changes in our marketing strategies. If this occurs, we may not be able to develop adequate alternative marketing strategies, which could have a material adverse impact on our results of operations.

Additionally, while we do not allow any third-party cookies, tags or trackers (collectively, “cookies”) to be placed in our software solutions, we utilize cookies on some of our public websites to collect data about visitors to our websites in order to administer our sites, enhance users’ web-browsing experience, analyze trends and gather information about users’ activities on our sites. Our ability to collect, analyze, use and share information collected via cookies is governed by U.S. and foreign laws and regulations which change from time to time, such as those regulating the level of consumer notice and consent required before a company can employ cookies to