Company: PHR
Filing Date: 2025-09-05
Form Type: 10-Q
Source: 0001412408-25-000062
Chunk: 423

Company: Phreesia, Inc.
Filing Date: 2025-09-05
Form: 10-Q
Item: Part I, Item 4
Chunk 423
---
 from quarter to quarter.

Privacy concerns, cyber-attacks, data breaches or cybersecurity incidents relating to our SaaS-based solutions could result in economic loss, damage to our reputation, deterring users from using our products, and exposure to legal penalties and liability.

We collect, process and store significant amounts of sensitive, confidential and proprietary information, including personally identifiable information, such as payment data and protected health information, of patients received in connection with the utilization of our solutions. Attacks on information technology systems are increasing in their frequency, levels of persistence, sophistication and intensity, they are being conducted by increasingly sophisticated and organized groups and individuals with a wide range of motives and expertise, and they may remain undetected for an extended period of time. For instance, as AI technologies, including generative AI models, develop rapidly, threat actors are using these technologies to create sophisticated new attack methods that are increasingly automated, targeted, coordinated and difficult to defend against. Like other companies in our industry, we, and our third party vendors, have experienced threats and cybersecurity incidents relating to our information technology systems and infrastructure. For example, in 2024, we experienced a cybersecurity incident which impacted our ConnectOnCall product. Although we do not believe this, or any other cybersecurity incident, has had a material impact on our business to date, any interruption in our business or disclosure, loss, processing or other compromise of personal information or individually identifiable health information (violating certain privacy laws such as HIPAA) or confidential information, or event that jeopardizes the confidentiality, integrity, or availability of our solutions, could result in a material disruption to our solutions and our business operations, require us to expend significant resources and subject us to litigation, fines and penalties. In addition to extracting sensitive information, such 

52

Table of Contents

attacks could include the deployment of harmful malware, ransomware, denial-of-service attacks, social engineering fraud (including phishing attacks), and other means to affect service reliability and threaten the confidentiality, integrity and availability of information. While we aim to maintain a robust security program for all of our products to protect such data, techniques used to gain unauthorized access to data and systems, disable or degrade service, or sabotage systems, are constantly evolving, and may be the result of criminal groups, state sponsored or other malicious actors. We may be unable to anticipate such techniques or implement adequate preventative measures to avoid unauthorized access or other adverse impacts to such data or our systems. 

In addition, some of our third-party service providers and partners, such as Change Healthcare and other