Company: PHR
Filing Date: 2025-03-13
Form Type: 10-K
Source: 0001412408-25-000010
Chunk: 69

Company: Phreesia, Inc.
Filing Date: 2025-03-13
Form: 10-K
Item: Item 1
Chunk 69
---
 safeguard the confidentiality, integrity and availability of our clients’ data. In particular, we deploy physical, administrative and technical controls to appropriately safeguard patient information. Our infrastructure is deployed to three co-located data centers, and within multiple Microsoft Azure and Amazon Web Service environments, to securely manage and maintain our clients’ information. 

We use external security auditors and industry-leading vendors, such as Sikich, A-LIGN, and Bluefin to ensure we have the controls and procedures in place to protect our clients’ sensitive information. We have industry certifications, including HITRUST, PCI-DSS Level 1 Service Provider, Systems and Organization Controls 2 ("SOC 2") and PCI Point-to-Point Encryption. As a PCI-DSS Level 1 Service Provider, we are committed to upholding industry security standards to cardholder data.

We are committed to protecting the information of and safeguarding privacy for our clients and their patients. To the extent we work as a third-party for our healthcare provider partners, we are a "Business Associate" as defined under the federal Health Insurance Portability and Accountability Act of 1996, as amended by the Health Information and Technology for Economic and Clinical Health Act ("HITECH Act") and their implementing regulations, collectively referred to as “HIPAA.” As a Business Associate, we sign Business Associate Agreements that govern our uses and disclosures of protected health information ("PHI") on behalf of our covered entity clients that engage us to provide our software solutions. In certain contexts, we also process personal data and consumer health data as a controller and are regulated by various federal and state laws when we do so, including the Federal Trade Commission Act, Washington’s My Health My Data Act, the California Consumer Privacy Act, and other similar U.S. state consumer privacy laws. Our publicly available privacy policies provide detailed information regarding how we protect consumers’ data and the data subject rights of consumers.

Refer to Item 1C. Cybersecurity in Part I of this Annual Report on Form 10-K for additional information regarding our processes to assess, identify and manage material risks from cybersecurity threats and our board’s role in overseeing risks from cybersecurity threats.

Sales and marketing 

We market and sell our products and services to healthcare services prospects throughout the U.S. using a direct sales organization. Our database team is responsible for the hygiene and health of our data and is tasked with validating information by using various tools to enrich it. This data powers our sales development organization. Our marketing team identifies customer profiles, develops content and deploys one-to-many communications