Phreesia Inc

Overview

We are a leading provider of comprehensive software solutions that improve the operational and financial performance of healthcare organizations and improve health outcomes by helping patients take a more active role in their care. Our solutions include SaaS-based integrated tools that manage patient access, registration and payments. We have tools to communicate with patients about their health and have demonstrated increased rates of preventive care and vaccinations. Additionally, our solutions include clinical assessments to screen patients for a variety of physical, behavioral and mental health conditions, helping providers to better understand their patients and connect them to needed services, resulting in improved health outcomes. We also provide life sciences companies, health plans and other payer organizations (payers), patient advocacy, public interest and other not-for-profit organizations with a channel for direct communication with patients. Our solutions also include additional products and services such as the MediFind provider directory, which helps patients find care based on providers' specific clinical expertise. In fiscal 2024, we facilitated patient visits in over 3,900 healthcare services clients across all 50 states. We define a patient visit as an individual, in-person or telehealth visit to a healthcare services provider, which may include multiple encounters by the same patient.

Patient intake is a complex and time-consuming process involving numerous tasks, including registration, insurance verification, patient questionnaires, patient-reported outcomes ("PROs"), payments and scheduling. Inefficiencies during the intake process often result in lower satisfaction for patients and healthcare services organizations, wasted time, missed revenue opportunities and diminished health outcomes. Phreesia’s mission is to make care easier every day. We have created an integrated and streamlined system that automates data capture and activates patients before, during and after their interaction with their healthcare services provider.

Our comprehensive range of technology solutions and services include initial patient contact, registration, appointment scheduling, payments, automated answering services, and post-appointment patient surveys. We securely collect and analyze each patient’s information and provide engagement tools to efficiently guide each patient through their healthcare journey. We deploy our solutions across a range of modalities, including through patients’ mobile devices (Phreesia Mobile), through a web-based dashboard for healthcare services clients (Phreesia Dashboard), and through our self-service intake tablets (PhreesiaPads) and on-site kiosks (Arrivals Kiosks), all of which provide an individualized experience for each patient based on age, gender, appointment type and other clinical and demographic factors. Our solutions are highly customizable and scalable to any size healthcare service organization and can seamlessly integrate within a client’s workflows and leading Practice Management, or PM, and Electronic Health Record, or EHR, systems. Our solutions additionally allow for secure time-of-service and post-explanation of benefits integrated payments.

We serve an array of healthcare services clients of all sizes across over 25 specialties, ranging from single-specialty practices, including internal and family medicine, urology, dermatology, and orthopedics, to large, multi-specialty groups, and health systems as well as regional and national payers and other organizations that provide other types of healthcare-related services. Our Network solutions revenue (as described below) is generated from clients in the pharmaceutical, biotechnology and medical device industries, as well as payers, patient advocacy, public interest and other not-for-profit organizations seeking to activate, engage and educate patients about topics critical to their health.

Our solutions

We offer our clients a comprehensive range of technology applications and modules that address the growing needs of the healthcare market by helping patients take a more active role in their care.

•Our access to care solutions provide a comprehensive appointment scheduling system to provide clients with applications for online appointments, reminders and referral tracking and management, in addition to managing inbound patient calls during and after business hours. Through our MediFind.com provider directory, we enable healthcare services clients to manage their MediFind provider profiles, helping patients to find the best doctors, latest medical advances and active clinical trials, and helping patients to book appointments.

•Our registration solutions automate patient self-registration before or at the time of the patient’s visit— via Phreesia Mobile or through the use of a purpose-built PhreesiaPad or Arrivals Kiosk for on-site check-in. Our

Phreesia Dashboard is used by healthcare services organization staff to monitor and manage the intake process. We also collect clinical intake and PRO data for more than 25 specialties, enabling our clients to ask the right clinical questions of the appropriate patients at the right time and gather key data that aligns with their quality-reporting goals.

•Our revenue cycle solutions provide insurance-verification processes, point-of-sale payments applications, post-visit payment collection and flexible payment options, which help healthcare services clients maximize the timely collection of patient payments.

•Our network solutions provide a channel to our life sciences and payer clients that leverages our large and growing network of over 3,900 healthcare services clients. On behalf of our life sciences and payer clients, we deliver clinically relevant content to patients and health plan members who voluntarily opt in to receive this type of engagement. Additionally, our DoctorFinder product allows Life Sciences companies to embed a doctor directory in their own websites, thereby helping patients find appropriate care for their unique needs.

Our market opportunity

We serve a range of healthcare services clients, including single-specialty practices, large multi-specialty groups and health systems. We provide services to large and small pharmaceutical, medical device and biotechnology companies as well as payer organizations. We believe our current addressable market is approximately $10.0 billion and is derived from: (1) the potential $6.3 billion of subscription and related services revenue generated from the approximately 1.4 million U.S.-based healthcare services organizations who take medical appointments in ambulatory care settings and healthcare service providers who work in hospital settings, (2) the estimated potential $2.3 billion of consumer-related transaction and payment processing fees, which are based on a percentage of payments that we process through our platform and address approximately $95.0 billion of annual out of pocket patient spend in ambulatory healthcare related professional services, (3) an estimated potential $1.9 billion in Network solutions revenue, based on projections of direct-to-consumer point-of-care marketing spend and other digital, direct-to-consumer life sciences marketing spend. We estimate that our target client universe in the ambulatory and hospital markets is approximately 50,000 unique healthcare services clients. As we develop new products and services, we expect our total addressable market to grow.

Our value proposition

We are focused on providing healthcare services organizations, life sciences companies and payer organizations the tools to help patients take a more active role in their care. We believe our solutions provide a unique value proposition that is differentiated from what is offered by the traditional healthcare system.

Value proposition for patients

•Improved patient experience. Our solutions streamline the patient intake process and provides consumer-centric options for check-in. We pre-populate information from prior visits, minimizing the frustration of repetitive questions during the intake process and streamlining the information for review by a clinician by the time the patient reaches the exam room. We also offer patients a convenient, flexible, secure intake experience that saves time and provides clarity regarding the amount of payment due. The MediFind provider directory helps patients find the right care for their unique needs. Patients are also able to save time by making their appointments using our technology. Additionally, our smart answering and after hours care solution improves the patient experience by routing incoming patient calls to the appropriate healthcare resources.

•Flexible payment options. We provide patients with flexibility and choice in how they pay for healthcare services. Patients are able to pay upfront or set up an automated payment plan that adheres to our healthcare services clients' financial policies. Patients can also choose to pay online on their healthcare services organization’s website or place a card on file, removing the need for difficult payment-related conversations with staff.

•Activation in care. By leveraging the power of self-service and providing individualized and flexible software solutions, we activate patients early in their healthcare journey and provide them with relevant information to further educate them so they can take an active role in their healthcare decisions.

Value proposition for healthcare services clients

•Simplify operations and enhance staff efficiency. We enable healthcare services clients to streamline operations through automated patient intake, automated answering services and payments that are integrated into existing workflows and PM and EHR systems. By automating the numerous tasks and forms associated with the intake process, our healthcare services clients have been able to save time on patient check-ins and inbound calls.

•Improve cash flow and profitability and gain new business. We enable our healthcare services clients to increase collections and reduce costs. Based on client feedback received and our internal analysis, we believe that our flexible patient payment options, including card on file, have led to an increase in time-of-service collections for the majority of our healthcare services clients. Our automated eligibility and benefits verification solution also reduces the number of denied claims. Additionally, the MediFind provider directory enables providers to enhance their visibility to prospective new patients by including their profiles in the provider directory.

•Enhance clinical and cost outcomes. We enable our healthcare services clients to more efficiently and effectively capture the right clinical information to meet their clinical goals and align with quality reporting initiatives. Our logic-driven delivery of PROs and other questionnaires help healthcare services clients identify at-risk patients in need of specific care and reduce errors by avoiding the need to manually gather the information. These PROs enable our healthcare services clients to close gaps in care, identify successful treatments and engage patients in their care. Through our subsidiary, Insignia Health, LLC ("Insignia"), we license the exclusive worldwide rights to the Patient Activation Measure ("PAM"®), which we believe is widely viewed as the gold standard of patient activation measures. Extensive research over the past decade suggests that the PAM could be a critical pathway in helping healthcare services clients achieve the goals of reducing costs and improving the health of their patients. Beginning in 2024, the Centers for Medicare and Medicaid Services ("CMS") includes the PAM Performance Measure ("PAM-PM") in its Merit-based Incentive Payments System ("MIPS").

•Improve patient experience. We activate patients through their journey from access to registration to drive higher patient satisfaction, retention and safety. Our streamlined intake and payments offering provides a consumer-friendly experience and activates patients to take control of their care. Additionally, after obtaining patient consent, we enable healthcare services clients to conduct outreach within 24 hours of visit and generate real-time feedback that informs and drives efforts to improve patient experience. Providers benefit from the increased volumes of patients able to find them through the MediFind provider directory. We also provide an automated answering service that routes and triages incoming patient calls to connect patients with the appropriate care during a practice's normal business hours, as well as a service that connects patients with the appropriate care after hours.

Value proposition for life sciences and payer organizations

•Direct communications. We provide life sciences and payer organizations with a channel to engage healthcare consumers who have voluntarily opted in for such communications, when they are most receptive and actively seeking care. Our data-driven solutions provide life sciences and payer organizations the ability to reach specific populations based on various demographic, clinical, environmental and social data, allowing our clients to activate patients and members with clinically or demographically relevant health content to help facilitate conversations with their providers about treatment and prevention options.

•Speed diagnosis and increase uptake of preventive health services. Our data and analytics capabilities identify patient populations that align with our life sciences clients’ audiences. Based on our ongoing analyses of client marketing and education campaigns conducted by data analytics companies, we believe patients exposed to our campaigns are more likely, on average, to receive a relevant diagnosis, undergo a preventive health screening, or receive a relevant treatment, than control patients.

•Improve brand conversion, treatment, and adherence. Our data and analytics capabilities identify patient populations that align with our life sciences clients’ audiences. Based on our ongoing analyses of client marketing campaigns conducted by data analytics companies, we believe patients exposed to a brand campaign using our solutions are more likely, on average, to take an action, such as initiating treatment, continuing treatment, or having a prescription filled for that product, than control patients.

•Learn about patient cohorts. Our Patient Insights solutions provide a channel for our life sciences clients to deliver surveys to patients and capture direct feedback and access relevant population insights.

Our competitive landscape

We compete in a dynamic patient intake market with direct and indirect competitors that maintain varying degrees of resources and capabilities. We believe many direct competitors are focused on the basic aspects of electronic patient intake and are only starting to expand into the multiple adjacencies beyond patient registration such as access and clinical support. Some of our existing and potential service providers, particularly EHR providers, have developed their own patient intake solutions and have become direct competitors. Our solutions integrate with a majority of the leading EHR systems.

We believe companies in the market for comprehensive software solutions, including patient intake, compete on the basis of several factors, including:

•price;

•breadth, depth, quality and reliability of product and service offerings;

•ease of use;

•ability to drive tangible return on investment;

•client-focused implementation services and training programs;

•healthcare domain expertise;

•patient clinical content offerings;

•client support and client services; and

•ability to integrate with all of a client’s existing systems, including EHR and/or PM systems.

Life sciences marketing is highly competitive and rapidly evolving and consists of both traditional media platforms (e.g. television and print media) as well as more modern web-based and application-based platforms that provide direct-to-consumer marketing for the life sciences industries. Our direct marketing solutions are unique and compete at the point of care as well as pre- and post-visit across an array of digital devices backed by our commitment to transparency and third-party auditing. We compete on the basis of several factors, including price, quality, transparency and the ability to demonstrate meaningful return on investment.

Our growth strategies

The success of our business depends on acquiring new clients and increasing utilization among our existing clients, which in turn drives growth across our solutions. We believe we are well-positioned to benefit from a number of prevailing industry tailwinds across our patient access, registration, revenue cycle and Network solution areas. We intend to continue to proactively grow the business through the following strategies:

Expanding our solutions to new healthcare services organizations

The market for a technology-powered intake and payment solution in the U.S. healthcare industry is large and underserved, and we believe we have a substantial opportunity to grow our client base and market share. With the ability to support over 25 different medical specialties and existing agreements with leading PM and EHR providers, we are able to serve a large portion of the U.S. ambulatory and acute care market. We currently serve a small percentage of ambulatory and acute care organizations, and we plan to continue to utilize our direct sales force to win new clients.

Deepening our relationship with existing healthcare services clients

We generate recurring fees from our healthcare services clients based on the number of subscriptions to our solutions and add-on applications. As our healthcare services clients realize the value our solutions offer, they typically purchase additional subscriptions for their organizations. Our sales strategy is focused on expanding our revenue per average healthcare services client ("AHSC") and we believe there is a significant opportunity to sell new applications.

Continuing to innovate and leverage our solutions

We believe our depth, scalability and robust capabilities allow us to address key challenges facing providers, payers and life sciences organizations. As an innovative leader across these segments of healthcare, we intend to continue to invest in new value-added offerings for our clients. We have a well-defined technology roadmap to introduce new features and functionality to our products. We intend to leverage our network and patient activation capabilities to eliminate gaps in care and increase care coordination among all key healthcare constituents. By expanding and continuously enhancing our solutions, we believe we can drive incremental revenue from existing clients as well as broaden our appeal to potential new clients.

Pursuing opportunistic strategic investments, partnerships and acquisitions

Our strong growth has included significant organic growth as we have added healthcare services and life sciences clients, while also expanding the solutions we offer those clients. Throughout our history, we have effectively contracted with leading PM and EHR solution providers and will continue to evaluate strategic and innovative investments and partnerships to accelerate growth. Phreesia has also acquired products and functionalities that expand our suite of solutions. We evaluate many investment, partnership and acquisition opportunities on an ongoing basis. We target opportunities that enhance the breadth or depth of our ability to activate patients in their care. Our acquisitions to date have all been consistent with this philosophy, and we will continue to evaluate growth opportunities that complement our internal initiatives.

Enhancing our margins through continued strategic growth

Our business model is based on developing and deploying new, value-added applications for our clients that increase revenue and enhance our attractive client unit economics. We have invested significantly and expect to continue investing significantly to create a comprehensive, scalable suite of solutions that allow us to gain operating leverage and enhance margins. Over time, we expect to increase profitability and margins by adding new clients and by expanding our existing clients with minimal incremental investment. Moreover, we continually aim to improve effectiveness and efficiency.

Our products and services

Our solutions are specifically designed to cater to the needs of patients, healthcare services clients and life sciences and payer companies while improving healthcare engagement.

Access to Care

We offer healthcare services clients convenient online appointment requests for patients, appointment tracking and appointment management in one place, and provide insight into past and upcoming appointments. Our Access to Care solutions include:

•Provider directory for patients seeking care. On MediFind.com, healthcare services clients in our network can manage and update their profiles, to help new patients discover their services and book appointments.

•Integrated patient scheduling. We give patients 24/7 access to request or schedule their own in-person or virtual appointments online, either through a link or by responding to patient-outreach by their provider. Once patients self-schedule or send an appointment request, their information automatically populates into the Phreesia Appointments Hub for staff to track and manage.

•Automated appointment rescheduling. Our appointment rescheduling tool is an automated, text-based solution designed to fill open slots on a healthcare services client's schedule with clinically relevant patients. The tool leverages artificial intelligence and a custom-rules engine to offer earlier appointments for eligible patients as soon as a time slot becomes available.

•Appointment reminders. With our appointment reminder solution, patients receive email, text, and voice reminders about upcoming in-person and virtual appointments, reducing no-shows for our healthcare services clients. Patient responses to confirm, cancel or reschedule appointments flow directly into the Phreesia Appointments Hub.

•Patient text messaging. We allow healthcare services clients to send and receive text messages from individual patients about their in-person or virtual visits. This capability helps to reduce face-to-face interactions, decrease phone-call volume and improve patient communication.

•After-hours care. PhreesiaOnCall helps healthcare services clients manage patients seeking care after-hours. A provider-facing app transcribes patient messages, routes to the on-call provider, and displays key information from the patient’s chart for a more productive call.

•Smart answering solution. We help healthcare services clients manage inbound patient calls digitally with the option to follow-up via text message, reducing burden on call center and front desk staff members.

Registration

Our Registration applications facilitate mobile and on-site check-in, create a more complete patient record and increase patient convenience and satisfaction. These solutions include:

•Mobile and in-office intake modalities. We allow patients to check in securely and conveniently on their computer or mobile device, either prior to their visit or when they arrive at the office. Patients can also update their clinical and demographic information, take a photo to store in their patient record, capture images of their driver’s license and insurance card, sign forms and policies and pay copays and outstanding balances—all from the privacy and ease of their own device.

•Registration for virtual visits. We support healthcare services clients offering telehealth by allowing them to perform all the necessary intake tasks for each virtual visit, including gathering consents, at scale. Intake for telehealth also provides patients with information about how their telehealth visit will work.

•Specialty-specific workflows. Our workflows cover over 25 specialties leveraging our proprietary logic to guide patients through a tailored list of questions, allowing them to efficiently enter and verify their demographics, insurance data and clinical information.

•Consent management. We streamline the process of collecting consents by ensuring that each patient receives the right forms. These forms can be customized by appointment type and can capture electronic signatures and send required forms directly to the PM or EHR system.

•Self service patient-reported outcomes and screenings.

•We deliver clinical assessments to screen patients for common morbidities, and we own the worldwide exclusive license to the PAM™, a measure that we believe is widely viewed as the gold standard for measuring patient activation.

•Behavioral health screenings for primary care. We identify and screens patients for common behavioral and mental health conditions, including depression, anxiety and substance abuse.

•Social determinants of health screening. We enable healthcare services clients to ask patients confidentially about their access to healthy food, safe housing and other social determinants that can have a critical impact on their health, to help healthcare services clients better understand patients and connect them to needed services.

Revenue cycle

We are able to improve key revenue cycle metrics with our payment solutions, increasing time-of-service and post-visit collections as well as improving patient convenience with online payments and card on file. Our Revenue Cycle solutions include:

•Point-of-service payments. We offer self-service payment options on Phreesia Mobile, on the PhreesiaPad or at an Arrivals Kiosk. Healthcare services client staff can also process time-of-service or post-explanation of benefits payments on the Phreesia Dashboard. We are able to replace or support a client’s existing payment processor with a fast and secure way to process transactions, as we accept all major credit cards (Visa, MasterCard, American Express and Discover), ApplePay, and other payment methods. Phreesia is a PCI DSS Level 1 Service Provider and offers PCI-compliant point-of-sale solutions that significantly reduce the client's PCI DSS reporting requirements.

•Insurance verification. Our automated eligibility and benefits application streamlines verification, reduces staff’s manual workload and alerts staff when attention is needed. We can run eligibility and benefits checks in advance, so our clients know their patients’ primary and secondary insurance before their visit.

•Payment plans. Our healthcare services clients can give patients the option to set up private, automated payment plans when they check in, or have the staff create payment plans for them on the Phreesia Dashboard. Each plan is configured according to the healthcare services client’s financial policies and managed automatically.

•Online payments. We allow practices to add a custom payment button to their website or send email reminders that direct patients to an online payment page.

•Card on file and payment assurance. Patients may sign a financial policy that gives authorization to store their payment card on our secure solution, thus automatically collecting payments once claims are adjudicated.

Network Solutions

We provide several opportunities for third parties to engage with the patients and providers who are using the tools and products we offer.

•Education and engagement before, during and after the visit. PatientConnect is our point of care offering which enables third parties to deliver personalized health content to users who opt to receive it after they have completed checking in for a doctor's appointment via Phreesia's intake software. Clients of this tool include life sciences organizations, health plans, and patient advocacy groups. Educational and promotional content about health is delivered to raise patient awareness and help patients start the right conversations with their providers, improving outcomes for these individuals. Educational material includes information about different therapy options to assist in advocating for their needs and preferences; disease education, which speeds up the time to diagnosis; screening tools and information to aid in early detection and disease prevention; and public service materials about vaccines, avoiding use of tobacco products, and more.

•Patient insights. Similar to delivery of educational materials, we conduct primary research among interested users after they check in for appointments via our intake software to understand sentiments and behaviors, uncover unmet needs, and learn about preferences and health beliefs. These insights aid clients in understanding their patients’ experiences and enhancing their existing products and services.

•Referral management. We offer a suite of referral management tools for healthcare services clients that enable them to track incoming referrals in a centralized list, send referrals to specialists, and check the status of each request.

Our technology

We have continued to enhance and develop our proprietary solutions with a focus on delivering reliability, performance, security and privacy. Our solutions have demonstrated scalability and robust integration within the operating infrastructure of our healthcare services clients. Our core technology capabilities include:

•Robust integration. We integrate our technology into PMs, EHRs and ambulatory and acute system workflows for over 3,900 healthcare services clients. Data captured from the patient or generated by the use of our solutions automatically integrate into the PM and EHR systems of healthcare services clients. We currently contract with leading PM and EHR providers that collectively represent the majority of the total PM and EHR market. These providers of PM and EHR solutions and our healthcare services clients can leverage our expanding APIs to embed the functionality of our solutions for their patients, while controlling the look and feel.

•Embedded payments. Our payment processing features have been designed to operate seamlessly within the workflows of our healthcare services clients, and our revenue cycle solutions can connect directly to those making payments, to multiple clearinghouses and directly with PM, EHR and other systems.

•Scalable at cost. Our robust and scalable SaaS-based solution allows us to iterate on existing technology and develop new solutions quickly and efficiently to meet the needs of our clients. Our unique architecture also allows new integrated applications to be quickly deployed to clients and allows real-time integration without expensive and difficult-to-manage VPN tunnels. This is particularly important in a regulatory environment and industry that continues to evolve.

•Consumer-oriented. Through technological innovation, we have continued to ensure our products and services evolve to meet growing and increasingly consumer-centric demands. Our technological innovations include enhancements to our user interface, which we believe has improved user experience, accessibility and satisfaction.

•Reliable. Our technology is engineered to provide strong reliability and availability. We process hundreds of thousands of transactions, including eligibility and benefits verification, payment card processing and email and text messaging, quickly and reliably at a low cost every day.

•Secure and private. We securely manage billions of data points for millions of patients using multiple devices. Maintaining the integrity of our solutions is critical to our business, our clients and the patients they treat. As our product offerings increase and become more robust, we continue to enhance and evolve our security program.

Privacy and security

Privacy and security are our top priorities. We maintain a comprehensive security program designed to safeguard the confidentiality, integrity and availability of our clients’ data. In particular, we deploy physical, administrative and technical controls to appropriately safeguard patient information.

We offer reliability, performance, security and privacy for our clients. We have infrastructure in place with three co-located data centers, and within Microsoft Azure and Amazon Web Service environments, to securely manage and maintain our clients’ information.

We use external security auditors and industry-leading vendors, such as Sikich, A-LIGN, and Bluefin to ensure we have the controls and procedures in place to protect our clients’ sensitive information. We have industry certifications, including HITRUST, PCI-DSS Level 1 Service Provider, Systems and Organization Controls 2 ("SOC 2") and PCI Point-to-Point Encryption. As a PCI-DSS Level 1 Service Provider, we are committed to upholding industry security standards to cardholder data.

We are committed to protecting the information and privacy of our clients and their patients. To the extent we work as a third-party for our healthcare provider partners, we are a "Business Associate" as defined under the federal Health Insurance Portability and Accountability Act of 1996, as amended by the Health Information and Technology for Economic ad Clinical Health Act ("HITECH Act") and their implementing regulations, collectively referred to as HIPAA. As a Business Associate, we sign Business Associate Agreements that govern our uses and disclosures of protected health information ("PHI") on behalf of our covered entity clients that engage us to provide our software solutions.

Refer to Item 1C. Cybersecurity in Part I of this Annual Report on Form 10-K for additional information regarding our processes to assess, identify and manage material risks from cybersecurity threats and our board’s role in overseeing risks from cybersecurity threats.

We market and sell our products and services to healthcare services prospects throughout the U.S. using a direct sales organization. Our database team is responsible for the hygiene and health of our data and is tasked with validating information by using various tools to enrich it. This data powers our sales development organization. Our marketing team identifies customer profiles, develops content and deploys one-to-many communications to soften the market. This helps prepare our sales development team to engage with new prospective customers. The sales development team creates opportunities and works with the direct sales team to qualify those opportunities. Our sales force executes on these qualified sales leads, partnering with sales enablement and client services to ensure prospects are educated on the breadth of our capabilities and demonstrable value proposition, with the goal of attracting and retaining clients and expanding their use of our solutions over time. Most of our healthcare services customer contracts are structured as annual, auto-renewing agreements. Our sales typically involve competitive processes, and sales cycles have, on average, varied in duration from three months to six months, depending on the size of the potential client. In addition, through Phreesia University (Phreesia’s in-house training program), events, client conferences and webinars, we help our healthcare services clients optimize their businesses and, as a result, support client retention.

We also sell products and services to life sciences and payer organizations, healthcare advertising agencies and advocacy groups as well as advertising agencies through our direct sales and marketing teams. Most of the life science campaigns need to be measured and resold each year. Like healthcare services, the marketing team supports net new business and client retention for life sciences by educating ideal customer profiles about the value of Phreesia and the positive impact on health outcomes Phreesia campaigns have on patients.

Subscriber services and support

Our operations and support organizations differentiate and enhance our clients’ and patients’ experience. Our teams have significant experience integrating with various EHR and PM systems, which can help take our healthcare services clients from sale to go-live much quicker than other solutions. Our client-focused operations are structured to provide a seamless process.

•Client services. Our dedicated Client Services team is responsible for pre-sales engagement, new client onboarding and implementation, existing client implementation and on-site optimization. Client Services is organized by market specialization, ensuring that our team provides deep expertise in the markets they support. In addition, our implementation teams have extensive knowledge of the PM and EHR systems that our healthcare services clients use. Through our designed implementation approach and expertise, we are able to take healthcare services clients live efficiently and quickly. Our Client Services team is also able to demonstrate early return on investment in land-and-expand deals, enabling us to roll out to additional locations.

•Client success. Our success is driven by our ability to retain and expand relationships with existing and new clients. Our dedicated Client Success team is focused on the retention of our client base, coordinating directly with Sales and Client Services to meet this objective. Furthermore, we are continuously expanding our business and enhancing our clients' experience by offering additional products to our clients and driving adoption and utilization.

•Client support. We provide technical support to our healthcare services clients through our dedicated Client Support team to directly resolve any product and/or service issues. We serve as the single starting point for client issues and offer a collaborative support model in contrast to tiered support models. This model has proven to help large companies continue to scale, while leveraging the benefits of smaller operations.

We are committed to providing quality services and support, with a focus on integration, implementation support and overall client satisfaction.

Regulatory Matters

Our business is subject to extensive, complex and rapidly changing federal and state laws and regulations. Various federal and state agencies have discretion to issue regulations and interpret and enforce healthcare laws. While we routinely evaluate our legal positions under applicable healthcare laws and regulations, these regulations can vary significantly from jurisdiction to jurisdiction, and interpretation and enforcement of existing laws and regulations can be uncertain or may change periodically. Moreover, in many jurisdictions in which we operate, neither our current nor our anticipated business model has been the subject of judicial or administrative interpretation. We cannot be assured that a review of our business by courts or regulatory authorities will not result in determinations that could adversely affect our operations or that the healthcare regulatory environment will not change in a way that restricts our operations. Federal and state legislatures also may enact various legislative proposals that could materially impact certain aspects of our business. In addition, our consumer transactions business is subject to certain financial services laws, regulations and rules, such as the Payment Card Industry Data Security Standards.

U.S. state and federal health information privacy and security laws

There are numerous U.S. federal and state laws and regulations related to the privacy and security of personally identifiable information, including health information. In particular, the Health Insurance Portability and Accountability Act of 1996, or HIPAA, establishes privacy and security standards that limit the use and disclosure of protected health information, referred to as PHI, and require the implementation of administrative, physical, and technical safeguards to ensure the confidentiality, integrity and availability of individually identifiable health information in electronic form. Many of our customers are regulated as covered entities under HIPAA. As a service provider who creates, receives, maintains or transmits PHI on behalf of our covered entity customers, Phreesia is a “business associate” as defined under HIPAA, and certain HIPAA requirements are directly applicable to business associates.

Violations of HIPAA may result in civil and criminal penalties and a single breach incident can result in violations of multiple standards. We must also comply with HIPAA’s breach notification rule. Under the breach notification rule, business associates must notify covered entities of a breach, and those covered entities must notify affected individuals without unreasonable delay in the case of a breach of unsecured PHI, which may compromise the privacy, security or integrity of the PHI. In addition, notification must be provided to the U.S. Department of Health and Human Services, or HHS, and the local media in cases where a breach affects more than 500 individuals. Breaches affecting fewer than 500 individuals must be reported to HHS on an annual basis. In the event of a breach, our covered entity customers may require we provide assistance in the breach notification process and may seek indemnification and other contractual remedies.

State attorneys general also have the right to prosecute HIPAA violations committed against residents of their states. While HIPAA does not create a private right of action that would allow individuals to sue in civil court for a HIPAA violation, its standards have been used as the basis for the duty of care in state civil suits, such as those for negligence or recklessness in misusing personal information. In addition, HIPAA mandates that HHS conduct periodic compliance audits of HIPAA covered entities and their business associates. It also tasks HHS with establishing a methodology whereby harmed individuals who were the victims of breaches of unsecured PHI may receive a percentage of the Civil Monetary Penalty fine paid by the violator. In light of the HIPAA Omnibus Final Rule, recent enforcement activity, and statements from HHS, we expect increased federal and state HIPAA privacy and security enforcement efforts.

There has been increasing focus on the application of HIPAA and other privacy laws to technology companies.

Other federal and state laws restrict the use and protect the privacy and security of personally identifiable information. For example, according to the Federal Trade Commission (FTC), failing to take appropriate steps to keep consumers’ personal information secure constitutes unfair acts or practices in or affecting commerce in violation of Section 5(a) of the Federal Trade Commission Act, 15 U.S.C. § 45(a). The FTC expects a company’s data security measures to be reasonable and appropriate in light of the sensitivity and volume of consumer information it holds, the size and complexity of its business and the cost of available tools to improve security and reduce vulnerabilities. Individually identifiable health information is considered sensitive data that merits stronger safeguards. In recent years, the FTC has paid increased attention to privacy and data security matters, and we expect them to continue to do so in the future.

Many states in which we operate and in which our patients reside also have laws that protect the privacy and security of sensitive and personal information, including health information, and are, in many cases, not preempted by HIPAA and may be subject to varying interpretations by courts and government agencies. These laws may be similar to or even more protective than HIPAA and other federal privacy laws. For example, the laws of the State of California, in which we operate, are more restrictive than HIPAA. The California Consumer Privacy Act, or CCPA, as amended by the California Privacy Rights Act, or CPRA, creates individual privacy rights for California consumers (as defined in the law) and places increased privacy and security obligations on entities handling personal data of consumers or households. The CCPA requires covered companies to provide certain disclosures to consumers about its data collection, use and sharing practices, and to provide affected California residents with ways to opt-out of certain sales or transfers of personal information. Additionally, as of January 1, 2023, California has a new state agency that is vested with authority to implement and enforce the CCPA. While any information we maintain in our role as a business associate may be exempt from the CCPA, other records and information we maintain may be subject to the CCPA.

We expect that there will continue to be new proposed and amended laws, regulations and industry standards concerning privacy, data protection and information security in the U.S. Already in the U.S. we have witnessed significant developments at the state level. In addition to the CCPA, new privacy and data security laws have been enacted in numerous other states and have been proposed in even more states as well as in the U.S. Congress, reflecting a trend toward more stringent privacy legislation in the U.S., which may accelerate. If enacted, such proposed legislation, may add additional complexity, variation in requirements, restrictions and potential legal risk, require additional investment of resources in compliance programs, impact strategies and the availability of previously useful data and could result in increased compliance costs and/or changes in business practices and policies. The existence of comprehensive privacy laws in different states in the country would make our compliance obligations more complex and costly and may increase the likelihood that we may be subject to enforcement actions or otherwise incur liability for noncompliance.

Where state laws are more protective than HIPAA, we must comply with these additional state laws. In certain cases, it may be necessary to modify our planned operations and procedures to comply with these more stringent state laws. Not only may some of these state laws impose fines and penalties upon violators, but also some state laws, unlike HIPAA, may afford private rights of action to individuals who believe their personal information has been misused. In addition, state laws are changing rapidly, and there is discussion of a new federal privacy law or federal breach notification law, to which we may be subject.

In addition to HIPAA, state health information privacy and state health information privacy laws, we may be subject to other state and federal privacy laws. Such laws, for example, could include state laws that prohibit unfair privacy and security practices and deceptive statements about privacy and security and laws that place specific requirements on certain types of activities, such as data security and texting.

In recent years, there have been a number of well publicized data breaches involving the improper use and disclosure of personally identifiable information and PHI. Many states have responded to these incidents by enacting laws requiring holders of personal information to maintain safeguards and to take certain actions in response to a data breach, such as providing prompt notification of the breach to affected individuals and state officials. In addition, under HIPAA and pursuant to the related contracts with our business associates, we must report breaches of unsecured PHI to our contractual partners following discovery of the breach. Notification must also be made in certain circumstances to affected individuals, federal authorities and others.

U.S. federal and state telecommunications laws

There are number of U.S. federal and state laws and regulations that concern telephone calls, text messages and other telephonic communications to patients, potential patients, clients, and potential clients. For example, the Telephone Consumer Protection Act (“TCPA”) is a federal statute that restricts certain calls and text messages to individuals. Some states, including Florida and Oklahoma, have mini-TCPA laws that restrict certain calls and text messages to their residents and mini-TCPA laws have been proposed in other state legislatures. Our call and text communications are or may be (or may become) subject to these laws.

U.S. federal contracting laws

Our subsidiary, Insignia, as a federal government contractor, is obligated to comply with applicable laws and regulations, including provisions of the Federal Acquisition Regulation ("FAR") and Section 508 of the Rehabilitation Act of 1973 (29 U.S.C. 794d), as amended by the Workforce Investment Act of 1998 ("Section 508"), in connection with its performance of its government contracts. Insignia’s obligations under the FAR include, for example, calculating overhead rates in accordance with the accounting procedures and internal controls required under the FAR standards. In addition, Insignia is obligated under Section 508 to ensure its services and products comply with federal accessibility standards. Consequences for violating the FAR and other laws and regulations applicable to government contracting include termination of contracts, suspension or debarment from doing future business with the government, criminal or civil remedies under the False Claims Act (as described below), and other penalties.

U.S. federal and state fraud and abuse laws

We are subject to additional healthcare regulation and enforcement by the federal government and by authorities in the states and foreign jurisdictions in which we conduct our business that may constrain the financial arrangements and relationships through which we research, as well as sell, market and distribute any products for which we obtain marketing authorization. Such laws include, without limitation, state and federal anti-kickback, fraud and abuse, false claims, and transparency laws and regulations related to drug pricing and payments and other transfers of value made to physicians and other healthcare providers. If our operations are found to be in violation of any of such laws or any other governmental regulations that apply, we may be subject to penalties, including, without limitation, administrative, civil and criminal penalties, damages, fines, disgorgement, the curtailment or restructuring of operations, integrity oversight and reporting obligations, exclusion from participation in federal and state healthcare programs and responsible individuals may be subject to imprisonment. Such laws and regulations include:

•the federal Anti-Kickback Statute, which prohibits, among other things, persons or entities from knowingly and willfully soliciting, receiving, offering or paying any remuneration (including any kickback, bribe or rebate), directly or indirectly, overtly or covertly, in cash or in kind, to induce, or in return for, the purchase, lease, order, arrangement, or recommendation of any good, facility, item or service for which payment may be made, in whole or in part, under a federal healthcare program, such as the Medicare and Medicaid programs. A person or entity does not need to have actual knowledge of this statute or specific intent to violate it to have committed a violation. In addition to a few statutory exceptions and regulatory safe harbors, the U.S. Department of Health and Human Services Office of Inspector General, or OIG, has published safe-harbor regulations that outline categories of activities that are deemed protected from prosecution under the Anti-Kickback Statute provided all applicable criteria are met. The failure of a financial relationship to meet all of the applicable safe harbor criteria does not necessarily mean that the particular arrangement violates the Anti-Kickback Statute. Violations are subject to civil and criminal fines and penalties for each violation, plus up to three times the remuneration involved, imprisonment, and exclusion from government healthcare programs. Moreover, the government may assert that a claim including items or services resulting from a violation of the Anti-Kickback Statute constitutes a false or fraudulent claim for purposes of the False Claims Act or federal civil monetary penalty laws;

•the federal civil and criminal false claims laws and civil monetary penalty laws, such as the federal False Claims Act, which impose criminal and civil penalties and authorize civil whistleblower or qui tam actions, against individuals or entities for, among other things: knowingly presenting, or causing to be presented, to the federal government, claims for payment that are false or fraudulent; knowingly making, using or causing to be made or used, a false statement of record material to a false or fraudulent claim or obligation to pay or transmit money or property to the federal government or knowingly concealing or knowingly and improperly avoiding or decreasing an obligation to pay money to the federal government. Manufacturers can be held liable under the federal False Claims Act even when they do not submit claims directly to government payors if they are deemed to “cause” the submission of false or fraudulent claims. The federal False Claims Act also permits a private individual acting as a “whistleblower” to bring actions on behalf of the federal government alleging violations of the federal False Claims Act and to share in any monetary recovery;

•HIPAA, which created new federal criminal statutes that prohibit a person from knowingly and willfully executing, or attempting to execute, a scheme to defraud any healthcare benefit program or obtain, by means of false or fraudulent pretenses, representations or promises, any of the money or property owned by, or under the custody or control of, any healthcare benefit program, regardless of the payor (e.g., public or private) and knowingly and willfully falsifying, concealing or covering up by any trick or device a material fact or making any materially false, fictitious, or fraudulent statements or representations in connection with the delivery of, or payment for, healthcare benefits, items or services relating to healthcare matters; similar to the federal Anti-Kickback Statute, a person or entity does not need to have actual knowledge of the statute or specific intent to violate it in order to have committed a violation;

•HIPAA, as amended by the Health Information Technology for Economic and Clinical Health Act of 2009, or HITECH and their respective implementing regulations, including the Final Omnibus Rule published in January 2013, which impose requirements on certain covered healthcare providers, health plans, and healthcare clearinghouses as well as their respective business associates, independent contractors or agents of covered entities, that perform services for them that involve the creation, maintenance, receipt, use, or disclosure of, individually identifiable health information relating to the privacy, security and transmission of individually identifiable health information. HITECH also created new tiers of civil monetary penalties, amended HIPAA to make civil and criminal penalties directly applicable to business associates, and gave state attorneys general new authority to file civil actions for damages or injunctions in federal courts to enforce the federal HIPAA laws and seek attorneys’ fees and costs associated with pursuing federal civil actions. In addition, there may be additional federal, state and non-U.S. laws which govern the privacy and security of health and other personal information in certain circumstances, many of which differ from each other in significant ways and may not have the same effect, thus complicating compliance efforts; and

•federal consumer protection and unfair competition laws, which broadly regulate marketplace activities and activities that potentially harm consumers.

Additionally, we are subject to state and foreign equivalents of each of the healthcare laws and regulations described above, among others, some of which may be broader in scope and may apply regardless of the payor. Many U.S. states have adopted laws similar to the federal Anti-Kickback Statute and False Claims Act, and may apply to our business practices, including, but not limited to, research, distribution, sales or marketing arrangements and claims involving healthcare items or services reimbursed by non-governmental payors, including private insurers. In addition, some states have passed laws that require pharmaceutical companies to comply with the April 2003 Office of Inspector General Compliance Program Guidance for Pharmaceutical Manufacturers and/or the Pharmaceutical Research and Manufacturers of America’s Code on Interactions with Healthcare Professionals. Several states also impose other marketing restrictions or require pharmaceutical companies to make marketing or price disclosures to the state and require the registration of pharmaceutical sales representatives. State and foreign laws, including for example the European Union General Data Protection Regulation, which became effective May 2018 also govern the privacy and security of health information in some circumstances, many of which differ from each other in significant ways and often are not preempted by HIPAA, thus complicating compliance efforts. There are ambiguities as to what is required to comply with these state requirements and if we fail to comply with an applicable state law requirement we could be subject to penalties. Finally, there are state and foreign laws governing the privacy and security of health information, many of which differ from each other in significant ways and often are not preempted by HIPAA, thus complicating compliance efforts.

Intellectual property

Our continued growth and success depend, in part, on our ability to protect our intellectual property and proprietary technology. We primarily protect our intellectual property through a combination of trademarks, trade secrets and other contractual rights, including confidentiality, non-disclosure and assignment-of-invention agreements with our employees, independent contractors, consultants and companies with which we conduct business.

However, these intellectual property rights and procedures may not prevent others from creating a competitive SaaS solution or otherwise competing with us. We may be unable to obtain, maintain and enforce the intellectual property rights on which our business depends, and assertions by third parties that we violate their intellectual property rights could have a material adverse effect on our business, financial condition and results of operations.

Human Capital Resources

As of January 31, 2024, we had 1,438 full-time employees, including 512 in sales and marketing, 473 in research and development, 294 in services and support and 159 in general and administrative. As of January 31, 2024, we had 946 full-time employees in the United States and 492 full-time employees internationally. We also supplement our workforce with contractors and consultants, including a substantial number of contractors and consultants in international locations. For example, as of January 31, 2024 we had a strategic relationship with Rayden Design Studio Private Ltd. (“Rayden”), pursuant to which approximately 1,000 Rayden India-based personnel supported our business through various functions, including, but not limited to, customer operations, research and development, product management and support, sales and marketing, and finance and accounting. None of our employees are represented by labor unions or covered by collective bargaining agreements. We consider our relationship with our employees to be good, and we have not experienced any work stoppages.

Talent and Culture: The success and continued evolution of our company has been due in large part to the talent and engagement of our entire team. Our team members are key pillars of our success and fostering and developing their talent is central to our culture. Attracting and retaining top talent is a high priority for us, and we look to hire smart, passionate, diverse and driven individuals who want to be a part of our mission. Our strong company culture and investment in long-term career growth for our people is evidenced by the long tenure of many of our team members with our organization. We believe our success is due in large part to the continued engagement of our talented and committed team. During our fiscal year ended January 31, 2024, Modern Healthcare magazine recognized Phreesia as one of the “Best Places to Work in Healthcare” for the seventh time, and Phreesia was named to the list of "The Top 100 Software Companies of 2023" by the Software Report, our second year in a row on the list. Additionally, Phreesia was named as one of 2023 Achievers 50 "Most Engaged Workplaces". Phreesia has also had representation on the Software Report's Top 50 Women Leaders in SaaS for the past six years. All of these achievements optimally position us to continue to attract top healthcare and technology talent.

Diversity and Inclusiveness: We are committed to hiring, developing and supporting a diverse and inclusive workplace. We employ strong recruiting practices that actively seek out and engage underrepresented groups. We strive to make career paths, career development opportunities and mentorships available to all employees. Additionally, we cultivate opportunities for diverse voices to be heard and supported. Our employee resource groups ("ERGs") support our commitment to promoting and maintaining an inclusive culture for all employees by bringing together individuals from a wide range of backgrounds, experiences and perspectives. These groups seek to foster a sense of shared community and empowerment for employees who share a common social identity, such as gender, race, ethnicity, disability and sexual orientation. Phreesians can voluntarily join an ERG to network, discuss and exchange ideas and enhance their professional development.

We recognize that our ability to execute on our mission of making care easier every day depends on our people. We are also committed to supporting gender equality in our organization, including through our inclusive culture, board representation, pathways to leadership for women, pay equity and strong family-leave policies.

We published our fourth Phreesia Gender Equality Report in 2023 based on the framework provided by the Bloomberg Gender Equality Index which has included Phreesia in January 2021, 2022, and 2023.

Remote Workforce: We have operated as a fully remote company since 2020, as we believe this arrangement allows us access to the best talent and creates optimal flexibility for our employees.

Corporate Information

We are a fully remote company and do not maintain principal executive offices. Our mailing address is 1521 Concord Pike, Suite 301, PMB 221, Wilmington, DE 19803, and our telephone number is (888) 654-7473. Our website address is http://www.phreesia.com. We do not incorporate the information on or accessible through our website into this report, and you should not consider any information on, or that can be accessed through, our website as part of this report.

Available Information

Our Annual Report on Form 10-K, Quarterly Reports on Form 10-Q, Current Reports on Form 8-K, and all amendments to these filings, are available free of charge from our investor relations website at https://ir.phreesia.com as soon as reasonably practicable following our filing with or furnishing to the Securities and Exchange Commission, or SEC, of any of these reports. The SEC maintains an Internet website at https:// www.sec.gov that contains reports, proxy and information statements, and other information regarding issuers that file electronically with the SEC.

Phreesia investors and others should note that we announce material information to the public about our company, products and services and other issues through a variety of means, including our website at https://www.phreesia.com, our investor relations website at https://ir.phreesia.com, press releases, SEC filings and public conference calls, in order to achieve broad, non-exclusionary distribution of information to the public. We also use the following social media channels as a means of disclosing information about the company, our solutions, our planned financial and other announcements and attendance at upcoming investor and industry conferences, and other matters and for complying with our disclosure obligations under Regulation FD:

PHREESIA Twitter Account (https://twitter.com/phreesia)

PHREESIA Facebook Page (https://www.facebook.com/phreesia/)

PHREESIA LinkedIn Page (https://www.linkedin.com/company/phreesia)

PHREESIA Instagram Account (https://www.instagram.com/phreesia.co)

PHREESIA News Page (https://www.phreesia.com/news/)

PHREESIA Life Sciences Twitter Account (https://twitter.com/PhreesiaLifeSci)

PHREESIA Life Sciences Facebook Page (https://www.facebook.com/PhreesiaLifeSciences/)

PHREESIA Life Sciences LinkedIn Page (https://www.linkedin.com/company/phreesia-life-sciences/)

PHREESIA Life Sciences Page (https://lifesciences.phreesia.com)

INSIGNIA Health website (https://www.insigniahealth.com/)

MEDIFIND website (https://www.medifind.com/)

We encourage our investors and others to review the information we make public in these locations as such information could be deemed to be material information. Please note that this list may be updated from time to time.

The contents of any website referred to in this Annual Report on Form 10-K are not intended to be incorporated into this Annual Report on Form 10-K or in any other report or document we file with the SEC, and any references to our websites are intended to be inactive textual references only.