Company: PHR
Filing Date: 2025-05-28
Form Type: 10-Q
Source: 0001412408-25-000039
Chunk: 34

Company: Phreesia, Inc.
Filing Date: 2025-05-28
Form: 10-Q
Item: Part II, Item 1A
Chunk 34
---
 comprehensive privacy and data protection laws that can impact our business. Some of the businesses we have acquired are subject to additional laws and regulations in jurisdictions outside of the United States, for example, the EU, in May 2018, adopted the General Data Protection Regulation, or EU GDPR, and the EU GDPR was incorporated into the laws of the United Kingdom (“UK GDPR”, together with the EU GDPR, “GDPR”). The GDPR in the EU and the UK, which have been incorporated into their respective laws, impose stringent requirements on the processing of health and other sensitive data. These requirements encompass: (i) providing information to individuals regarding data processing activities; (ii) ensuring a legal basis or condition applies to the processing of personal data and, where applicable, obtaining consent from individuals to whom the data processing relates; (iii) responding to data subject requests; (iv) imposing requirements to notify the competent national data protection authorities and data subjects of personal data breaches; (v) implementing safeguards in connection with the security and confidentiality of the personal data; (vi) accountability requirements; and (vii) taking certain measures when engaging third-party processors. Compliance with such laws and regulations requires resources and could be more costly and take more time than we anticipate, and could involve new fines or penalties for non-compliance, all of which could adversely affect our business. 

We have operations in Canada, where our collection, use, disclosure and management of personal information must comply with both federal and provincial privacy laws, which impose separate requirements, but may overlap in some instances. The Personal Information Protection and Electronic Documents Act ("PIPEDA") applies in all Canadian provinces except Alberta, British Columbia and Québec, as well as to the transfer of consumer data across provincial borders. PIPEDA imposes stringent consumer data protection obligations, requires privacy breach reporting and limits the purposes for which organizations may collect, use, and disclose consumer data. The provinces of Alberta, British Columbia and Québec have enacted separate data privacy laws that are substantially similar to PIPEDA, but all three additionally apply to our handling of our own employees’ personal data within their respective provinces. Notably, Québec’s Act respecting the protection of personal information in the private sector (the “Private Sector Act”), was amended by Bill 64, an Act to modernize legislative provisions as regards the protection of personal information, which introduced major amendments to the Private Sector Act, notably, to impose significant and stringent new obligations on Québec businesses while increasing the powers of Quebec’s supervisory authority. We may incur additional costs and expenses