Company: PHR
Filing Date: 2025-12-09
Form Type: 10-Q
Source: 0001412408-25-000132
Chunk: 337

Company: Phreesia, Inc.
Filing Date: 2025-12-09
Form: 10-Q
Item: Part I, Item 2
Chunk 337
---
 or even prevent us from offering certain services in specific jurisdictions. In addition, any limitation on our ability to use or transmit health information outside of the U.S. could impose restrictions on our ability to recruit and maintain employees residing outside of the U.S., which could, in turn, adversely affect our business.

Specifically, regulators and legislators in the U.S. are increasingly scrutinizing and restricting certain personal data transfers and transactions involving foreign countries. For example, the Biden Administration’s Executive Order 14117 on Preventing Access to Americans’ Bulk Sensitive Personal Data and United States Government-Related Data by Countries of Concern, as implemented by Department of Justice regulations issued in December 2024, prohibits data brokerage transactions involving certain sensitive personal data categories, including health data, genetic data, and biospecimens, to countries of concern, including China. The regulations also restrict certain investment agreements, employment agreements, and vendor agreements involving such data and countries of concern, absent specified cybersecurity controls. Actual or alleged violations of these regulations may be punishable by criminal and/or civil sanctions, and may result in exclusion from participation in federal and state programs. While Phreesia does not currently transfer data to these countries of concern, we are continuing to monitor the applicability of these new regulations and similar rules that may be enacted from time to time.

We expect that there will continue to be new or amended laws, regulations, standards and obligations proposed and enacted in various foreign jurisdictions. Many countries around the world have enacted comprehensive privacy and data protection laws that can impact our business. Some of the businesses we have acquired are subject to additional laws and regulations in jurisdictions outside of the U.S. For example, in Europe, organizations that collect or otherwise process personal data in connection with (a) the activities of a business establishment within the European Economic Area/United Kingdom; or (b) offering goods or services to/monitoring the behavior of individuals within these territories are subject to the EU General Data Protection Regulation, or EU GDPR, and the EU GDPR as incorporated into the laws of the United Kingdom following Brexit (“UK GDPR”, together with the EU GDPR, “GDPR”). The GDPR, alongside supplementary local data protection laws in the EU and the UK, impose stringent requirements on the processing of personal data, with heightened obligations for health and other sensitive data. These requirements include: (i) providing information to individuals regarding data processing activities; (ii) ensuring a legal basis or condition applies to the processing of personal data and, where applicable, obtaining consent from 

71

individuals to whom