VEEVA SYSTEMS INC

Previous wording

In our fiscal year ended January 31, 2024, we derived approximately 52% of our subscription services revenues and approximately 50% of our total revenues from our Commercial Solutions. In our fiscal quarter ended January 31, 2024, we derived approximately 50% of our subscription services revenues and approximately 49% of our total revenues from our Commercial Solutions. A significant percentage of our Commercial Solutions subscription services revenues are derived from subscriptions for our core CRM application, and we have realized substantial sales penetration among pharmaceutical and biotechnology companies for our core CRM application. If we are not able to sell additional user subscriptions for our core CRM application, if we fail to renew existing subscriptions for our core CRM application, or if subscription levels for our core CRM application are reduced at renewal (as a result of reductions in sales representatives that use our solutions, change in demand for our solutions, or for other reasons), the growth of our Commercial Solutions revenues may be negatively impacted. For example, in recent years, certain life sciences companies have reduced the number of sales representatives they employ due to an increased preference for digitally-enabled sales channels, which negatively impacted sales of Veeva CRM and certain of our other Commercial Solutions.

Current wording

In our fiscal year ended January 31, 2024, we derived approximately 52% of our subscription services revenues and approximately 50% of our total revenues from our Commercial Solutions. In our fiscal quarter ended July 31, 2024, we derived approximately 48% of our subscription services revenues and approximately 47% of our total revenues from our Commercial Solutions. A significant percentage of our Commercial Solutions subscription services revenues are derived from subscriptions for our core CRM application, and we have realized substantial sales penetration among pharmaceutical and biotechnology companies for our core CRM application. If we are not able to sell additional user subscriptions for our core CRM application, if we fail to renew existing subscriptions for our core CRM application, or if subscription levels for our core CRM application are reduced at renewal (as a result of reductions in sales representatives that use our solutions, change in demand for our solutions, or for other reasons), the growth of our Commercial Solutions revenues may be negatively impacted. For example, in recent years, certain life sciences companies have reduced the number of sales representatives they employ due to an increased preference for digitally-enabled sales channels, which negatively impacted sales of Veeva CRM and certain of our other Commercial Solutions.

Previous wording

Under the European General Data Protection Regulation (EU GDPR) and the United Kingdom’s General Data Protection Regulation (UK GDPR), we act as a data controller for our data products and a data processor with respect to our software products. Each of the GDPR and UK GDPR impose significant data protection obligations and provide for substantial penalties and other remedies for noncompliance. We maintain active self-certifications under the EU-U.S. Data Privacy Framework, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework as set forth by the U.S. Department of Commerce. We also rely on EU, UK and Swiss Standard Contractual Clauses, as well as our technical, contractual, and security measures, to help ensure that our European customers have the appropriate legal mechanisms in place for their personal data to be accessed from within the United States. We are required to take steps to legitimize any personal data transfers impacted by these developments, and to engage in contract negotiations with third parties that aid in processing personal data on our behalf. We may be subject to increased costs of compliance and limitations on our service providers and us. In addition, these laws are complex, with the application and interpretation of them, at times, unclear and inconsistent, and there may be significant penalties inmposed for non-compliance. For example, in May 2023, the Irish Data Protection Commission imposed a significant fine on a large internet technology corporation for its failure to sufficiently address risks to EU data subjects when transferring data to the U.S.

Current wording

Under the European General Data Protection Regulation (EU GDPR) and the United Kingdom’s General Data Protection Regulation (UK GDPR), we act as a data controller for our data products and a data processor with respect to our software products. Each of the GDPR and UK GDPR impose significant data protection obligations and provide for substantial penalties and other remedies for noncompliance. We maintain active self-certifications under the EU-U.S. Data Privacy Framework, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework as set forth by the U.S. Department of Commerce. We also rely on EU, UK and Swiss Standard Contractual Clauses, as well as our technical, contractual, and security measures, to help ensure that our European customers have the appropriate legal mechanisms in place for their personal data to be accessed from within the United States. We are required to take steps to legitimize any personal data transfers impacted by these developments, and to engage in contract negotiations with third parties that aid in processing personal data on our behalf. We may be subject to increased costs of compliance and limitations on our service providers and us. In addition, these laws are complex, with the application and interpretation of them, at times, unclear and inconsistent, and there may be significant penalties imposed for non-compliance. For example, in May 2023, the Irish Data Protection Commission imposed a significant fine on a large internet technology corporation for its failure to sufficiently address risks to EU data subjects when transferring data to the U.S.

Previous wording

Other countries have imposed or may in the future impose data localization obligations, cross-border data transfer restrictions, and other country specific privacy and security requirements which could be problematic to cloud software providers. For example, in 2021, China adopted the Personal Information Protection Law, which, together with the Cybersecurity Law and the Data Security Law, require companies that process personal data of China residents above certain thresholds to seek approval from the Cyberspace Administration of China (CAC) to transfer such data outside of China. In 2023, certain of our Veeva CRM customers in China were required to request such approval from the CAC and had their requests denied. Customers required to request approval may need to implement a CRM solution that does not require data to be transferred outside of China and customers not subject to the requirement may nonetheless choose to do so. While we offer a CRM solution, called China SFA, that does not require data to be transferred outside of China, certain of these customers may choose to implement a competitor’s CRM solution and our CRM business in China may be negatively impacted. Currently, approximately 2% of our total revenue is attributable to China.

Current wording

Other countries have imposed or may in the future impose data localization obligations, cross-border data transfer restrictions, and other country specific privacy and security requirements which could be problematic to cloud software providers. For example, in 2021, China adopted the Personal Information Protection Law, which, together with the Cybersecurity Law and the Data Security Law, require companies that process personal data of China residents above certain thresholds to seek approval from the Cyberspace Administration of China (CAC) to transfer such data outside of China. In 2023, certain of our Veeva CRM customers in China were required to request such approval from the CAC and had their requests denied. Customers required to request approval may need to implement a CRM solution that does not require data to be transferred outside of China and customers not subject to the requirement may nonetheless choose to do so. While we offer the China CRM Suite, a CRM solution that does not require data to be transferred outside of China, some customers have chosen and other customers may choose other CRM providers, which may negatively impact our CRM business in China. Currently, approximately 2% of our total revenue is attributable to China.

Previous wording

U.S. federal and state data privacy laws are rapidly evolving. These laws impose new and modify existing obligations on businesses that collect personal information and create new privacy rights for individuals. For example, under the California Consumer Privacy Act (CCPA), as amended, we are generally considered a “service provider” for our software solutions and a “business” for our data and analytics products. Some of these laws and regulations also target certain types of marketing and advertising based on the use of personal information. The State of Washington, for example, passed the My Health My Data Act, which became effective on March 21, 2024,

Current wording

U.S. federal and state data privacy laws are rapidly evolving. These laws impose new and modify existing obligations on businesses that collect personal information and create new privacy rights for individuals. For example, under the California Consumer Privacy Act (CCPA), as amended, we are generally considered a “service provider” for our software solutions and a “business” for our data products. Some of these laws and regulations also target certain types of marketing and advertising based on the use of personal information. The State of Washington, for example, passed the My Health My Data Act, which became effective on March 21, 2024,

Previous wording

establishing significant new restrictions on how businesses can collect, use, and disclose consumer health data. Veeva Crossix’s data platform combines large-scale data sets, inclusive of de-identified health and consumer data, to provide insights, analytics, and audience segmentation for our life sciences customers in the U.S. The law may curtail our ability to use data of Washington consumers, which may limit the accuracy of and reduce demand for our Crossix products, which, in turn, could adversely impact the business. These various laws, regulations, and legislative developments have potentially far-reaching consequences and may require us to modify our solutions and data management practices and incur substantial expense in order to comply.

Current wording

establishing significant new restrictions on how businesses can collect, use, and disclose consumer health data. Veeva Crossix’s data platform combines large-scale data sets, inclusive of de-identified health and consumer data, to provide insights, analytics, and audience segmentation for our life sciences customers in the U.S. In response to the Washington law, we made modifications to our audience segments that may reduce demand for our Crossix products, which, in turn, could adversely impact the business. These various laws, regulations, and legislative developments have potentially far-reaching consequences and have and may continue to require us to modify our solutions and data management practices and incur substantial expense in order to comply.

Previous wording

Our success and ability to compete depend in part upon our intellectual property. As of April 30, 2024, we have filed numerous domestic and foreign patent applications and have been issued 74 U.S. patents and 13 international patents. We also rely on copyright, trade secret and trademark laws, trade secret protection and confidentiality or license agreements with our employees, customers, partners, consultants and others to protect our intellectual property rights. However, the steps we take to protect our intellectual property rights may be inadequate and we may not be able to prevent the unauthorized disclosure or use of our technical knowledge, trade secrets or other confidential information. Further, if there is a breach or violation of the terms of our confidentiality agreements, we may not have adequate remedies.

Current wording

Our success and ability to compete depend in part upon our intellectual property. As of July 31, 2024, we have filed numerous domestic and foreign patent applications and have been issued 79 U.S. patents and 13 international patents. We also rely on copyright, trade secret and trademark laws, trade secret protection and confidentiality or license agreements with our employees, customers, partners, consultants and others to protect our intellectual property rights. However, the steps we take to protect our intellectual property rights may be inadequate and we may not be able to prevent the unauthorized disclosure or use of our technical knowledge, trade secrets or other confidential information. Further, if there is a breach or violation of the terms of our confidentiality agreements, we may not have adequate remedies.