Company: PHR
Filing Date: 2025-12-09
Form Type: 10-Q
Source: 0001412408-25-000132
Chunk: 479

Company: Phreesia, Inc.
Filing Date: 2025-12-09
Form: 10-Q
Item: Part I, Item 4
Chunk 479
---
 business. We may be unable to make such changes and modifications in a commercially reasonable manner or at all, and our ability to develop new products and features could be limited. Any of these developments could harm our business, financial condition and results of operations. Privacy and data security concerns, whether valid or not valid, may inhibit retention of services by existing clients or adoption of our services by new clients.

Existing laws regulate our ability to engage in direct marketing, and changes in privacy laws could adversely affect our ability to market our products effectively and could impact our results from operations or result in costs and fines.

We rely on a variety of direct marketing techniques, including email marketing. These activities are regulated by legislation such as the Controlling the Assault of Non-Solicited Pornography and Marketing Act of 2003 (“CAN-

72

SPAM Act”). Any failure by us to comply fully with the CAN-SPAM Act may leave us subject to substantial fines and penalties. In addition, any future restrictions in laws such as the CAN-SPAM Act, and various United States state laws, or new federal laws regarding marketing and solicitation or international data protection laws that govern these activities could adversely affect the continuing effectiveness of our marketing efforts and could force changes in our marketing strategies. If this occurs, we may not be able to develop adequate alternative marketing strategies, which could have a material adverse impact on our results of operations.

Additionally, while we do not allow any third-party cookies, tags or trackers (collectively, “cookies”) to be placed in our software solutions, we utilize cookies on some of our public websites to collect data about visitors to our websites in order to administer our sites, enhance users’ web-browsing experience, analyze trends and gather information about users’ activities on our sites. Our ability to collect, analyze, use and share information collected via cookies is governed by U.S. and foreign laws and regulations which change from time to time, such as those regulating the level of consumer notice and consent required before a company can employ cookies to collect data about interactions with users online. 

In recent years, there has been increasing public and regulatory scrutiny of the use of cookies by companies in the healthcare space. For example, the FTC has brought enforcement actions against online healthcare services and service providers, and there has been an increase in litigation alleging the unauthorized collection and sharing of sensitive health information in violation of federal and state privacy laws. While we do not collect HIPAA-regulated PHI via the use of cookies on our websites, and we believe our use of cookies on