Phreesia Inc

Previous wording

We have grown rapidly in recent periods, and as a result, our expenses have continued to increase. If we fail to manage our growth effectively, our revenue may not increase, and we may be unable to implement our business strategy.

Current wording

We have grown rapidly in recent periods. If we fail to manage our growth effectively, our revenue may not increase, and we may be unable to implement our business strategy.

Previous wording

We have experienced significant growth in recent periods, which puts strain on our business, operations and employees. We anticipate that our operations will continue to expand. As we continue to grow, both organically and through acquisitions, we must effectively integrate, develop, and manage an increasingly distributed employee base in a fully remote working environment. We may find it challenging to maintain the same level of employee productivity while executing our growth plan, fostering collaboration, and maintaining the beneficial aspects of our culture, and any such failures could negatively affect our future success, including our ability to attract and retain highly qualified employees and to achieve our business objectives.

Current wording

We have experienced significant growth in recent periods. Rapid expansion puts strain on our business, operations and employees. We anticipate that our operations will continue to expand. As we continue to grow, both organically and through acquisitions, we must effectively integrate, develop, and manage an increasingly distributed employee base in a fully remote working environment. We may find it challenging to maintain the same level of employee productivity while executing our growth plan, fostering collaboration, and maintaining the beneficial aspects of our culture, and any such failures could negatively affect our future success, including our ability to attract and retain highly qualified employees and to achieve our business objectives. If we do not manage the demands of our growing operations effectively, our efficiency may decline, our operations could be disrupted, and we may not be able to meet our financial projections, which could adversely affect our business performance and stock price.

Previous wording

Failure to effectively manage our growth could also lead us to over-invest or under-invest in development and operations, result in weaknesses in our infrastructure, systems or controls, give rise to operational mistakes, financial losses, loss of productivity or business opportunities and result in loss of employees and reduced productivity of remaining employees. In addition, our growth has required and is expected to require significant capital expenditures and may divert financial resources from other projects such as the development of new applications and services. We may also need to make further investments in our technology and automate portions of our solutions or our services to decrease our costs. If our management is unable to effectively manage our growth, our revenue may not increase (including sufficiently to offset our expenses) or may grow more slowly than expected, and we may be unable to implement our business strategy.

Current wording

Failure to effectively manage our growth could also lead us to over-invest or under-invest in development and operations, result in weaknesses in our infrastructure, systems or controls, give rise to operational mistakes, financial losses, loss of productivity or business opportunities and result in loss of employees and reduced productivity of remaining employees. If our management is unable to effectively manage our growth, our revenue may not increase (including sufficiently to offset our expenses) or may grow more slowly than expected, and we may be unable to implement our business strategy.

Previous wording

The success of our business and growth strategy depend upon our continued ability to maintain and expand a network of healthcare services clients. If we are unable to attract and retain healthcare services clients, it would have a material adverse effect on our business and ability to grow and would adversely affect our results of operations.

Current wording

The success of our business and growth strategy depend upon our continued ability to maintain and expand a network of healthcare services clients, which also requires us to provide and develop new high-quality products and services that are helpful to our clients and used and positively received by patients. If we are unable to attract and retain healthcare services clients, including because we are unable to adapt to new industry standards in developing new products and services, it would have a material adverse effect on our business and ability to grow and would adversely affect our results of operations. Additionally, if we do not maintain our current client network, or if we have to renegotiate existing contracts, our business, financial condition and results of operations will be harmed.

Previous wording

In addition, as we and the EHR and PM solutions with which we integrate, grow and expand product offerings, the EHR and PM solutions with which we integrate could offer more competitive services. Some of these EHR and PM systems offer, or may begin to offer, services, including patient intake and engagement services, payment processing tools and direct patient communication services, in the same or similar manner as we do. Although there are many potential opportunities for, and applications of, these services, these EHR and PM systems may seek opportunities or target new clients in areas that may overlap with those that we have chosen to pursue. Such competition from these EHR and PM systems may adversely affect our business, market share and results from operations.

Current wording

In addition, as we and the EHR and PM solutions with which we integrate, grow and expand product offerings, the EHR and PM solutions with which we integrate could offer more competitive services or make it more cost prohibitive to do business with them. Some of these EHR and PM systems offer, or may begin to offer, services, including patient intake and engagement services, payment processing tools and direct patient communication services, in the same or similar manner as we do. Although there are many potential opportunities for, and applications of, these services, these EHR and PM systems may seek opportunities or target new clients in areas that may overlap with those that we have chosen to pursue. Such competition from these EHR and PM systems may adversely affect our business, market share and results from operations.

Previous wording

We compete on the basis of several factors, including breadth, depth and quality of product and service offerings, ability to deliver clinical, financial and operational performance improvement through the use of products and services, quality and reliability of services, ease of use and convenience, brand recognition, price and the ability to integrate our solutions with various EHR and PM systems and other technology. Some of our competitors have greater name recognition, longer operating histories and significantly greater resources than we do. As a result, our competitors may be able to respond more quickly and effectively than we can to new or changing opportunities, technologies, standards or client requirements. In addition, current and potential competitors have established, and may in the future establish, cooperative relationships with vendors of complementary products, technologies or services to increase the availability of their products to the marketplace. Accordingly, new competitors or providers of EHR and PM solutions may emerge that have greater market share, larger client bases, more widely adopted proprietary technologies, greater marketing expertise, greater financial resources and larger sales forces than we have, which could put us at a competitive disadvantage. We also may be subject to pricing pressures as a result of, among other things, competition within the industry, consolidation of healthcare industry participants, practices of managed care organizations, government action and financial stress experienced by our clients. If our pricing experiences significant downward pressure, our business will be less profitable and our results of operations will be adversely affected. We cannot be certain that we will be able to retain our current clients or expand our client base in this competitive environment. If we do not retain current clients or expand our client base, or if we have to renegotiate existing contracts, our business, financial condition and results of operations will be harmed. Moreover, we expect that competition will continue to increase as a result of consolidation in both the healthcare information technology and healthcare industries. If one or more of our competitors or potential competitors were to merge or partner with another of our competitors, the change in the competitive landscape could also adversely affect our ability to compete effectively and could harm our business, financial condition and results of operations.

Current wording

We compete on the basis of several factors. Some of our competitors have greater name recognition, longer operating histories and significantly greater resources than we do. As a result, our competitors may be able to respond more quickly and effectively than we can to new or changing opportunities, technologies, standards or client requirements. In addition, current and potential competitors have established, and may in the future establish, cooperative relationships with vendors of complementary products, technologies or services to increase the availability of their products to the marketplace. Accordingly, new competitors or providers of EHR and PM solutions may emerge that have greater market share, larger client bases, more widely adopted proprietary technologies, greater marketing expertise, greater financial resources and larger sales forces than we have, which could put us at a competitive disadvantage. We also may be subject to pricing pressures as a result of, among other things, competition within the industry, consolidation of healthcare industry participants, practices of managed care organizations, government action and financial stress experienced by our clients. If our pricing experiences significant downward pressure, our business will be less profitable and our results of operations will be adversely affected. Moreover, we expect that competition will continue to increase as a result of consolidation in both the healthcare information technology and healthcare industries. If one or more of our competitors or potential competitors were to merge or partner with another of our competitors, the change in the competitive landscape could also adversely affect our ability to compete effectively and could harm our business, financial condition and results of operations.

Previous wording

•technical difficulties or interruptions in our services, like the one we are experiencing currently with ConnectOnCall;

Current wording

•technical difficulties or interruptions in our services, like the one we experienced with ConnectOnCall;

Previous wording

Privacy concerns, cyber-attacks, security breaches or incidents relating to our SaaS-based solutions could result in economic loss, damage to our reputation, deterring users from using our products, and our exposure to legal penalties and liability.

Current wording

Privacy concerns, cyber-attacks, security breaches or incidents relating to our SaaS-based solutions could result in economic loss, damage to our reputation, deterring users from using our products, and exposure to legal penalties and liability.

Previous wording

We collect, process and store significant amounts of sensitive, confidential and proprietary information, including personally identifiable information, such as payment data and protected health information, of patients received in connection with the utilization of our solutions. Attacks on information technology systems are increasing in their frequency, levels of persistence, sophistication and intensity, they are being conducted by increasingly sophisticated and organized groups and individuals with a wide range of motives and expertise, and they may remain undetected for an extended period of time. Like many healthcare companies, we recently experienced an interruption in our operations as a result of unauthorized access to one of our services, and we may experience such interruptions again in the future. Although we do not believe the security incident has had a material impact on our business to date, any disclosure, loss, processing or other compromise of personal information or individually identifiable health information (violating certain privacy laws such as HIPAA) or confidential information, or event that jeopardizes the confidentiality, integrity, or availability of our solutions, could result in a material disruption to our solutions and our business operations. In addition to extracting sensitive information, such attacks could include the deployment of harmful malware, ransomware, denial-of-service attacks, social engineering and other means to affect service reliability and threaten the confidentiality, integrity and availability of information. The prevalent use of mobile devices also increases the risk of data security incidents. While we believe we have taken reasonable steps to protect such data, techniques used to gain unauthorized access to data and systems, disable or degrade service, or sabotage systems, are constantly evolving, and we may be unable to anticipate such techniques or implement adequate preventative measures to avoid unauthorized access or other adverse impacts to such data or our systems. In addition, some of our third-party service providers and partners, such as Change Healthcare and other clearinghouses, also collect and/or store our sensitive information and our clients' data on our behalf, and these service providers and partners are subject to similar threats of cyber-attacks and other malicious internet-based activities, which could also expose us to risk of loss, litigation, and potential liability. Even though we may have contractual protections with such vendors, contractors, or other organizations, notifications and follow-up actions related to a cybersecurity breach could impact our reputation, cause us to incur significant costs, including legal expenses, harm customer confidence, expose us to government enforcement action, hurt our expansion into new markets, cause us to incur remediation costs, or cause us to lose existing customers. The risk of state-supported and geopolitical-related cybe…

Excerpt shortened here; the source contains the full paragraph.

Current wording

We collect, process and store significant amounts of sensitive, confidential and proprietary information, including personally identifiable information, such as payment data and protected health information, of patients received in connection with the utilization of our solutions. Attacks on information technology systems are increasing in their frequency, levels of persistence, sophistication and intensity, they are being conducted by increasingly sophisticated and organized groups and individuals with a wide range of motives and expertise, and they may remain undetected for an extended period of time. Like many healthcare companies, we recently experienced an interruption in our operations as a result of unauthorized access to one of our services, and we may experience such interruptions again in the future. Although we do not believe the security incident has had a material impact on our business to date, any disclosure, loss, processing or other compromise of personal information or individually identifiable health information (violating certain privacy laws such as HIPAA) or confidential information, or event that jeopardizes the confidentiality, integrity, or availability of our solutions, could result in a material disruption to our solutions and our business operations. In addition to extracting sensitive information, such attacks could include the deployment of harmful malware, ransomware, denial-of-service attacks, social engineering and other means to affect service reliability and threaten the confidentiality, integrity and availability of information. The prevalent use of mobile devices also increases the risk of data security incidents. While we believe we have taken reasonable steps to protect such data, techniques used to gain unauthorized access to data and systems, disable or degrade service, or sabotage systems, are constantly evolving, and we may be unable to anticipate such techniques or implement adequate preventative measures to avoid unauthorized access or other adverse impacts to such data or our systems.

Previous wording

We recently established a subsidiary in India to perform a number of functions that were previously performed by outside contractors, and we hired a significant number of employees from our outside contractor in India to bring those services in-house. While we believe our Indian operations are advantageous to our business, they also create risks that we must effectively manage. The management of our Indian operations has, and will continue to, require significant management attention and financial resources that could adversely affect our operating performance. Wages in India are increasing at a faster rate than those in many countries, including the United States. In addition, with the significant increase in the numbers of foreign businesses that have established operations in India, the competition to attract and retain employees there has increased significantly. As a result, we may be unable to cost-effectively retain our current employee base in India or hire additional new talent. In addition, India has experienced significant inflation, low growth in gross domestic product and shortages of foreign exchange. India also has experienced civil unrest and terrorism and, in the past, has been involved in conflicts with neighboring countries.

Current wording

We have a subsidiary in India that performs a number of functions that were previously performed by outside contractors. While we believe our Indian operations are advantageous to our business, they also create risks that we must effectively manage. The management of our Indian operations has, and will continue to, require significant management attention and financial resources that could adversely affect our operating performance. Wages in India are increasing at a faster rate than those in many countries, including the United States. In addition, with the significant increase in the numbers of foreign businesses that have established operations in India, the competition to attract and retain employees there has increased significantly. As a result, we may be unable to cost-effectively retain our current employee base in India or hire additional new talent. In addition, India has experienced significant inflation, low growth in gross domestic product and shortages of foreign exchange. India also has experienced civil unrest and terrorism and, in the past, has been involved in conflicts with neighboring countries. The occurrence of any of these circumstances could result in disruptions to our India operations, which, if continued for an extended period of time, could have a material adverse effect on our business. Further, conducting business abroad may subject us to increased legal and regulatory compliance and oversight. A failure to comply with applicable laws and regulations could result in regulatory enforcement actions, as well as substantial civil and criminal penalties assessed against us and our employees.

Previous wording

We also generate Network solutions revenue through fees charged to our life sciences and payer clients by delivering direct communications to help activate, engage and educate patients who authorize the delivery of, or "opt-in" to, such communications about topics critical to their health. The growth of our revenue stream from life sciences and payer clients is driven, in part, by our ability to grow our network of healthcare services clients and available population of patients to engage, our ability to achieve adequate patient opt-in rates, the number of newly approved drugs and the success of newly launched drugs, each of which is impacted by factors outside of our control. If there is a reduction in newly approved drugs, or newly launched drugs are not successful, this could negatively affect the ability of our life sciences clients to deliver relevant messages to patients who would have otherwise been candidates to receive such drugs, and accordingly may reduce patient opt-in rates. A reduction in the available population of patients to engage or a decline in patient opt-in rates or a lack of relevant content could lead to a decrease in our Network solutions revenue, which could harm our business, financial condition and results of operations.

Current wording

We also generate Network solutions revenue through fees charged to our life sciences and payer clients by delivering direct communications to help activate, engage and educate patients who authorize the delivery of, or "opt-in" to, such communications about topics critical to their health. The growth of our revenue stream from life sciences and payer clients is driven, in part, by our ability to grow our network of healthcare services clients and available population of patients to engage, our ability to achieve adequate patient opt-in rates, the number of newly approved drugs, the success of newly launched drugs, and the continued success of certain types of drugs, each of which is impacted by factors outside of our control. If there is a reduction in newly approved drugs, newly launched drugs are not successful, or certain drugs’ popularity decreases, this could negatively affect the ability of our life sciences clients to deliver relevant messages to patients who would have otherwise been candidates to receive such drugs, and accordingly may reduce patient opt-in rates. A reduction in the available population of patients to engage or a lack of relevant content could lead to a decrease in our Network solutions revenue, which could harm our business, financial condition and results of operations.

Previous wording

Market estimates and growth forecasts that we disclose are subject to significant uncertainty and are based on assumptions and estimates that may not prove to be accurate. The estimates and forecasts relating to the size and expected growth of the market for our services may prove to be inaccurate. These estimates and forecasts may be impacted by economic uncertainty that is outside our control, including international conflicts that may impact international trade and global economic performance and other macroeconomic trends, such as international and domestic supply chain risks, inflationary pressure, interest rate increases and declines in consumer confidence that impact our customers.

Current wording

Market estimates and growth forecasts that we disclose are subject to significant uncertainty and are based on assumptions and estimates that may not prove to be accurate. The estimates and forecasts relating to the size and expected growth of the markets for our services may prove to be inaccurate. These estimates and forecasts may be impacted by economic uncertainty that is outside our control, including international conflicts that may impact international trade and global economic performance and other macroeconomic trends, such as international and domestic supply chain risks, inflationary pressure, interest rate increases and declines in consumer confidence that impact our customers.

Previous wording

The principal assumptions relating to our market opportunity include the number of healthcare services organizations currently taking appointments, the amount of annual out of pocket consumer spend for healthcare-related services, and the amount of annual spend by life sciences and payer companies on direct communications with patients at the point of care. Our market opportunity is also based on the assumption that the strategic approach that Phreesia enables for our potential clients will be more attractive in creating efficiencies in patient care than competing solutions.

Current wording

The principal assumptions relating to our market opportunity include the number of healthcare services organizations currently taking appointments, the amount of annual out of pocket consumer spend for healthcare-related services, and the amount of annual spend by life sciences and payer companies on direct communications with patients at the point of care. Our market opportunity is also based on the assumption that the strategic approach that Phreesia enables for our potential clients will be more attractive in creating efficiencies in patient care than competing solutions. If these assumptions prove inaccurate, our business, financial condition and results of operations could be adversely affected.

Previous wording

Our clients and patients depend on our support services to resolve any technical issues relating to our solutions and our services, and we may be unable to respond quickly enough to accommodate short-term increases in demand for support services, particularly as we increase the size of our client bases (including healthcare services clients and the number of patients that they serve). In addition, we may experience unexpected service interruptions due to cyber-attacks or other security incidents, such as the one affecting our ConnectOnCall product. In such cases, we may be unable to restore service in a timely manner, if at all. We also may be unable to modify the format of our support services to compete with changes in support services provided by competitors. It is difficult to predict client and patient demand for technical support services, and if client or patient demand increases significantly, we may be unable to provide satisfactory support services to our clients. Further, if we are unable to address the needs of our clients and their patients in a timely fashion or further develop and enhance our solutions, or if a client or patient is not satisfied with the quality of work performed by us or with the technical support services rendered, then we could incur additional costs to address the situation or be required to issue credits or refunds for amounts related to unused services, and our profitability may be impaired and clients’ or patients’ dissatisfaction with our solutions could damage our ability to expand the number of applications and services purchased by such clients. These clients may not renew their contracts, seek to terminate their relationships with us or renew on less favorable terms. Moreover, negative publicity related to our client and patient relationships, or regarding patient confidentiality and privacy in the context of technology-enabled healthcare, regardless of its accuracy, may further damage our business by affecting our reputation or ability to compete for new business with current and prospective clients. If any of these were to occur, our revenue may decline and our business, financial condition and results of operations could be adversely affected.

Current wording

Our clients and patients depend on our support services to resolve any technical issues relating to our solutions and our services, and we may be unable to respond quickly enough to accommodate short-term increases in demand for support services, particularly as we increase the size of our client bases (including healthcare services clients and the number of patients that they serve). In addition, we may experience unexpected service interruptions due to cyber-attacks or other security incidents, such as the one that affected our ConnectOnCall product. In such cases, we may be unable to restore service in a timely manner, if at all. We also may be unable to modify the format of our support services to compete with changes in support services provided by competitors. It is difficult to predict client and patient demand for technical support services, and if client or patient demand increases significantly, we may be unable to provide satisfactory support services to our clients. Further, if we are unable to address the needs of our clients and their patients in a timely fashion or further develop and enhance our solutions, or if a client or patient is not satisfied with the quality of work performed by us or with the technical support services rendered, then we could incur additional costs to address the situation or be required to issue credits or refunds for amounts related to unused services, and our profitability may be impaired and clients’ or patients’ dissatisfaction with our solutions could damage our ability to expand the number of applications and services purchased by such clients. These clients may not renew their contracts, seek to terminate their relationships with us or renew on less favorable terms. Moreover, negative publicity related to our client and patient relationships, or regarding patient confidentiality and privacy in the context of technology-enabled healthcare, regardless of its accuracy, may further damage our business by affecting our reputation or ability to compete for new business with current and prospective clients. If any of these were to occur, our revenue may decline and our business, financial condition and results of operations could be adversely affected.

Previous wording

We have incurred significant operating losses since our inception. For the three months ended April 30, 2024 and the years ended January 31, 2024 and January 31, 2023, we had net losses of $19.7 million, $136.9 million and $176.1 million, respectively, and losses from operations of $19.4 million, $136.5 million and $176.6 million respectively. Our operating expenses may increase in the foreseeable future as we continue to invest to grow our business and build relationships with our clients and partners, develop new solutions and operate as a public company. In addition, to the extent we are successful in increasing our client base, we could incur increased losses because significant costs associated with entering into client agreements are generally incurred up front, while revenue is generally recognized ratably over the term of the agreement. As a result, we may need to raise additional capital through equity and debt financings in order to fund our operations, which may not be available to us on favorable terms or at all. If we are unable to effectively manage these risks and difficulties as we encounter them or effectively access the capital markets, our business, financial condition and results of operations may suffer.

Current wording

We have incurred significant operating losses since our inception. For the three and six months ended July 31, 2024 and the years ended January 31, 2024 and January 31, 2023, we had net losses of $18.0 million, $37.7 million, $136.9 million and $176.1 million, respectively, and losses from operations of $17.2 million, $36.6 million, $136.5 million and $176.6 million respectively. Our operating expenses may increase in the foreseeable future as we continue to invest to grow our business and build relationships with our clients and partners, develop new solutions and operate as a public company. In addition, to the extent we are successful in increasing our client base, we could incur increased losses because significant costs associated with entering into client agreements are generally incurred up front, while revenue is generally recognized ratably over the term of the agreement. As a result, we may need to raise additional capital through equity and debt financings in order to fund our operations, which may not be available to us on favorable terms or at all. If we are unable to effectively manage these risks and difficulties as we encounter them or effectively access the capital markets, our business, financial condition and results of operations may suffer.

Previous wording

Our success depends, in part, on the skills, working relationships and continued services of our founders, Chaim Indig (Chief Executive Officer) and Evan Roberts (Chief Operating Officer), and senior management team and other key personnel. From time to time, there may be changes in our senior management team resulting from the hiring or departure of executives, which could disrupt our business. In addition, our shift to a remote work environment could make it increasingly difficult to manage our business and adequately oversee our employees and business functions, potentially resulting in harm to our company culture, increased employee attrition, and the loss of key personnel.

Current wording

Our success depends, in part, on the skills, working relationships and continued services of our founders, Chaim Indig (Chief Executive Officer) and Evan Roberts (Chief Operating Officer), and senior management team and other key personnel. From time to time, there may be changes in our senior management team resulting from the hiring or departure of executives, which could disrupt our business.

Previous wording

In addition, we must attract, train and retain a significant number of highly skilled employees, including sales and marketing personnel, client support personnel, professional services personnel, software engineers, technical personnel and management personnel, and the availability of such personnel, in particular software engineers, may be constrained. We also believe that our future growth will depend on the continued development of our direct sales force and its ability to obtain new clients and to manage our existing client base. If we are unable to hire and develop sufficient numbers of productive direct sales personnel or if new direct sales personnel are unable to achieve desired productivity levels in a reasonable period of time, sales of our services will suffer and our growth will be impeded.

Current wording

In addition, we must attract, train and retain a significant number of highly skilled employees in the U.S., India and Canada, including sales and marketing personnel, client support personnel, professional services personnel, software engineers, technical personnel and management personnel, and the availability of such personnel, in particular software engineers, may be constrained. We also believe that our future growth will depend on the continued development of our direct sales force and its ability to obtain new clients and to manage our existing client base. If we are unable to hire and develop sufficient numbers of productive direct sales personnel or if new direct sales personnel are unable to achieve desired productivity levels in a reasonable period of time, sales of our services will suffer and our growth will be impeded.

Previous wording

We may become subject to litigation in the future. Some of these claims may result in significant defense costs and potentially significant judgments against us, some of which we are not, or cannot be, insured against. We generally intend to defend ourselves vigorously; however, we cannot be certain of the ultimate outcomes of any claims that may arise in the future. Resolution of these types of matters against us may result in our having to pay significant fines, judgments or settlements, which, if uninsured, or if the fines, judgments and settlements exceed insured levels, could adversely impact our earnings and cash flows, thereby having a material adverse effect on our business, financial condition, results of operations, cash flow and per share trading price of our common stock. Certain litigation or the resolution of certain litigation may affect the availability or cost of some of our insurance coverage, which could adversely impact our results of operations and cash flows, expose us to increased risks that would be uninsured and adversely impact our ability to attract directors and officers.

Current wording

We may become subject to litigation in the future. Some of these claims may result in significant defense costs and potentially significant judgments against us, some of which we are not, or cannot be, insured against. We generally intend to defend ourselves vigorously; however, we cannot be certain of the ultimate outcomes of any claims that may arise in the future. Resolution of these types of matters against us may result in our having to pay significant fines, judgments or settlements, which, if uninsured, or if the fines, judgments and settlements exceed insured levels, could adversely impact our earnings and cash flows, thereby having a material adverse effect on our business, financial condition, results of operations, cash flow and per share trading price of our common stock. For example, while we attempt to limit, by contract, our liability for damages arising from our negligence, errors, mistakes or security breaches, and maintain liability insurance coverage, including coverage for cybersecurity and errors and omissions, claims may exceed the amount of our applicable insurance coverage or this coverage may not continue to be available on acceptable terms or in sufficient amounts. Certain litigation or the resolution of certain litigation may affect the availability or cost of some of our insurance coverage, which could adversely impact our results of operations and cash flows, expose us to increased risks that would be uninsured and adversely impact our ability to attract directors and officers.

Previous wording

Our payments platform is a core element of our business. For the three months ended April 30, 2024 and the fiscal year ended January 31, 2024, our payments platform generated 27% and 27% of our total revenue, respectively. Our future success depends in part on the continued growth and development of our payments platform. If such activities are limited, restricted, curtailed or degraded in any way, or if we fail to continue to grow and develop our payments platform, our business may be materially and adversely affected. The utilization of our payment processing tools may be impacted by factors outside of our control, such as disruptions in the payment processing industry generally. If the number of patients utilizing our payments platform, or the aggregate amounts paid by such patients directly to our healthcare services clients through our payments platform, were to be reduced as a result of disruptions in the payment processing industry or other factors, it could result in a decrease to our revenue, which could harm our business, financial condition and results of operations. In addition, some potential or existing clients may not desire to use our payment processing services or to switch from their existing payment processing vendors for a variety of reasons, such as transition costs, business disruption, and loss of accustomed functionality. There can be no assurance that our efforts to overcome these factors will be successful, and this resistance may adversely affect our growth.

Current wording

Our payments platform is a core element of our business. For the three and six months ended July 31, 2024 and the fiscal year ended January 31, 2024, our payments platform generated 25%,26% and 27% of our total revenue, respectively. Our future success depends in part on the continued growth and development of our payments platform. If such activities are limited, restricted, curtailed or degraded in any way, or if we fail to continue to grow and develop our payments platform, our business may be materially and adversely affected. The utilization of our payment processing tools may be impacted by factors outside of our control, such as disruptions in the payment processing industry generally. If the number of patients utilizing our payments platform, or the aggregate amounts paid by such patients directly to our healthcare services clients through our payments platform, were to be reduced as a result of disruptions in the payment processing industry or other factors, it could result in a decrease to our revenue, which could harm our business, financial condition and results of operations. In addition, some potential or existing clients may not desire to use our payment processing services or to switch from their existing payment processing vendors for a variety of reasons, such as transition costs, business disruption, and loss of accustomed functionality. There can be no assurance that our efforts to overcome these factors will be successful, and this resistance may adversely affect our growth.

Previous wording

We provide a payments solution for the secure processing of patient payments. Our payment processing tools can connect to multiple clearinghouses and can also connect directly with patients. We have developed partnerships with primary credit card processors in the United States to facilitate payment processing, and we are registered with Visa, MasterCard, American Express, Discover and other card networks as a service provider (payment facilitator or the equivalent) for acquiring member institutions. These card networks set the operating rules and standards with which we must comply. The termination of our status as a certified service provider, a decision by the card networks to disallow payment facilitators or bar us from serving as such, or any changes in network rules or standards, including interpretation and implementation of the operating rules or standards, that increase the cost of doing business or limit our ability to provide transaction processing services to our clients or partners, could adversely affect our business, financial condition or results of operations.

Current wording

Visa, MasterCard, American Express, Discover and other card networks as a service provider (payment facilitator or the equivalent) for acquiring member institutions. These card networks set the operating rules and standards with which we must comply. The termination of our status as a certified service provider, a decision by the card networks to disallow payment facilitators or bar us from serving as such, or any changes in network rules or standards, including interpretation and implementation of the operating rules or standards, that increase the cost of doing business or limit our ability to provide transaction processing services to our clients or partners, could adversely affect our business, financial condition or results of operations.

Previous wording

We pay interchange fees to the card networks or the card issuers for each transaction we process. The card networks may increase, from time to time, the fees that they charge members or service providers. Although we may attempt to pass these increases along to our clients, this may result in the loss of clients to our competitors that do not pass along the increases. A provision of the Dodd-Frank Wall Street Reform and Consumer Protection Act (the "Dodd-Frank Act") known as the Durbin Amendment empowered the Board of Governors of the Federal Reserve System, ("FRS"), to establish and regulate a cap on the interchange fees that issuers (e.g. banks) may charge or receive for electronic clearing of debit card transactions. The original regulations implementing the Durbin Amendment established standards for assessing whether debit card interchange fees received by debit card issuers were reasonable and proportional to the costs incurred by issuers for electronic debit transactions, and it established a maximum permissible interchange fee that an issuer may receive for an electronic debit transaction, limiting the fee revenue to debit card issuers and payment processors. In November 2023, the FRS proposed amendments to Regulation II that would, if adopted as proposed, significantly lower the maximum permissible interchange fee for such transactions, and such maximum would be reevaluated every two years. To the extent that HSA-linked payment cards and other exempt payment cards (or their issuing banks, such as those having assets of $10 billion) lose their exempt status under the current rules, or if any interchange rate caps applicable to the debit card, credit card or other payment cards are changed, any such amendment, rule-making, or legislation could impact interchange rates applicable to payment card transactions processed through our payments platform. As a result, this could decrease our revenue and profit and could have a material adverse effect on our financial condition and results of operations.

Current wording

We pay interchange fees to the card networks or the card issuers for each transaction we process. The card networks may increase, from time to time, the fees that they charge members or service providers. Although we may attempt to pass these increases along to our clients, this may result in the loss of clients to our competitors that do not pass along the increases. A provision of the Dodd-Frank Wall Street Reform and Consumer Protection Act (the "Dodd-Frank Act") known as the Durbin Amendment empowered the Board of Governors of the Federal Reserve System, ("FRS"), to establish and regulate a cap on the interchange fees that issuers (e.g. banks) may charge or receive for electronic clearing of debit card transactions. The original regulations implementing the Durbin Amendment established standards for assessing whether debit card interchange fees received by debit card issuers were reasonable and proportional to the costs incurred by issuers for electronic debit transactions, and it established a maximum permissible interchange fee that an issuer may receive for an electronic debit transaction, limiting the fee revenue to debit card issuers and payment processors. In November 2023, the FRS proposed amendments to Regulation II that would, if adopted as proposed, significantly lower the maximum permissible interchange fee for such transactions, and such maximum would be reevaluated every two years. To the extent that HSA-linked payment cards and other exempt payment cards (or their issuing banks, such as those having assets of less than $10 billion) lose their exempt status under the current rules, or if any interchange rate caps applicable to the debit card, credit card or other payment cards are changed, any such amendment, rule-making, or legislation could impact interchange rates applicable to payment card transactions processed through our payments platform. As a result, this could decrease our revenue and profit and could have a material adverse effect on our financial condition and results of operations.

Previous wording

Even when HIPAA does not apply, according to the Federal Trade Commission, or the FTC, failing to take appropriate steps to keep consumers’ personal information secure constitutes unfair acts or practices in or affecting commerce in violation of Section 5(a) of the Federal Trade Commission Act, or the FTCA, 15 U.S.C. § 45(a). The FTC expects a company’s data security measures to be reasonable and appropriate in light of the sensitivity and volume of consumer information it holds, the size and complexity of its business, and the cost of available tools to improve security and reduce vulnerabilities. Individually identifiable health information is considered sensitive data that merits stronger safeguards. The FTC’s current guidance for appropriately securing consumers’ personal information is similar to what is required by the HIPAA security regulations, but this guidance may change in the future, resulting in increased complexity and the need to expend additional resources to ensure we are complying with the FTCA.

Current wording

Even when HIPAA does not apply, according to the Federal Trade Commission, or the FTC, failing to take appropriate steps to keep consumers’ personal information secure constitutes unfair acts or practices in or affecting commerce in violation of Section 5(a) of the Federal Trade Commission Act, or the FTCA, 15 U.S.C. § 45(a). The FTC’s current guidance for appropriately securing consumers’ personal information is similar to what is required by the HIPAA security regulations, but this guidance may change in the future, resulting in increased complexity and the need to expend additional resources to ensure we are complying with the FTCA.

Previous wording

Other federal and state laws restrict the use and protect the privacy and security of personally identifiable information are, in many cases, are not preempted by HIPAA and may be subject to varying interpretations by the courts and government agencies. These varying interpretations can create complex compliance issues for us and our partners and potentially expose us to additional expense, adverse publicity and liability, any of which could adversely affect our business.

Current wording

Other federal and state laws restrict the use and protect the privacy and security of personally identifiable information, in many cases, are not preempted by HIPAA and may be subject to varying interpretations by the courts and government agencies. These varying interpretations can create complex compliance issues for us and our partners and potentially expose us to additional expense, adverse publicity and liability, any of which could adversely affect our business.

Previous wording

There is ongoing concern from privacy advocates, regulators and others regarding data privacy and security issues, and the number of jurisdictions with data privacy and security laws has been increasing. Also, there are ongoing public policy discussions regarding whether the standards for de-identification, anonymization or pseudonymization of health information are sufficient, and the risk of re-identification sufficiently small, to adequately protect patient privacy. We expect that there will continue to be new proposed and amended laws, regulations and industry standards concerning privacy, data protection and information security in the United States, such as the CCPA, as amended by the California Privacy Rights Act, or CPRA, which amendments went into effect on January 1, 2023. The CCPA creates specific obligations with respect to processing and storing personal information, and the CPRA amendments created a new state agency that is vested with authority to implement and enforce the CCPA. In addition to the CCPA, new privacy and data security laws have been enacted in numerous states and have been proposed in even more states as well as the U.S. Congress. If passed, these new laws could impose similar or more restrictive requirements than these recently enacted laws.

Current wording

We expect that there will continue to be new proposed and amended laws, regulations and industry standards concerning privacy, data protection and information security in the United States, such as the CCPA, as amended by the California Privacy Rights Act, or CPRA, which amendments went into effect on January 1, 2023. The CCPA creates specific obligations with respect to processing and storing personal information, and the CPRA amendments created a new state agency that is vested with authority to implement and enforce the CCPA. In addition to the CCPA, new privacy and data security laws have been enacted in numerous states and have been proposed in even more states as well as the U.S. Congress. If passed, these new laws could impose similar or more restrictive requirements than these recently enacted laws.

Previous wording

We also expect that there will continue to be new or amended laws, regulations, standards and obligations proposed and enacted in various jurisdictions. Many countries around the world have enacted comprehensive privacy and data protection laws that can impact our business. For example, in May 2018, the General Data Protection Regulation, or GDPR, went into effect in the European Union, or EU. The GDPR imposes more stringent data protection requirements and requires businesses subject to it to give more detailed disclosures about how they collect, use, and share personal information; contractually commit to data protection measures in contracts; maintain adequate data security measures; notify regulators and affected individuals of certain data breaches; obtain consent to collect sensitive personal information such as health information or ensuring another appropriate legal basis or condition applies to the processing of personal information; meet extensive privacy governance and documentation requirements; and honor individuals’ data protection rights. The GDPR also imposes strict rules on the transfer of personal information to countries outside of the European Economic Area, or EEA to jurisdictions that the European Commission (EC) does not recognize as having “adequate” data protection laws. These transfers are prohibited unless a valid transfer mechanism is implemented, such as the Standard Contractual Clauses (SCCs) published by the EC, binding corporate rules or certification to the EU-U.S. Data Privacy Framework that the EC adopted on July 10, 2023. Evolving laws and decisions surrounding transfers of EU personal information have increased the legal risks and liabilities, and compliance and operational costs, of lawfully making such transfers. Companies that violate the GDPR can face private litigation, restrictions, or prohibitions on data processing, and fines of up to the greater of 20 million Euros or 4% of worldwide annual revenue.

Current wording

Regulation UK GDPR, or UK GDPR (with respect to UK personal data), as well as other supplementary national data protection legislation in force in EEA member states and the UK (including the UK Data Protection Act 2018), together referred to as the “GDPR” in this Quarterly Report. The GDPR imposes stringent data protection requirements and requires businesses subject to it to give more detailed disclosures about how they collect, use, and share personal information; contractually commit to data protection measures in contracts; maintain adequate data security measures; notify regulators and affected individuals of certain data breaches; obtain consent to collect sensitive personal information such as health information or ensuring another appropriate legal basis or condition applies to the processing of personal information; meet extensive privacy governance and documentation requirements; and honor individuals’ data protection rights. The GDPR also prohibits the transfer of personal information to countries outside of the European Economic Area, or EEA and United Kingdom, or UK to jurisdictions that do not have “adequate” data protection laws by appropriate authorities, including the United States in certain circumstances. Unless a valid transfer mechanism is implemented, such as the Standard Contractual Clauses (SCCs) published by the EC, the UK International Data Transfer Agreement (UK IDTA) published by the ICO binding corporate rules or certification to the EU-U.S. Data Privacy Framework that the EC adopted on July 10, 2023 (along with its UK and Swiss extensions.) Where relying on the SCCs or UK IDTA for data transfers, we may also be required to carry out transfer impact assessments to assess whether the recipient is subject to local laws which allow public authority access to personal data. Evolving laws and decisions surrounding transfers of EU personal information have increased the legal risks and liabilities, and compliance and operational costs, of lawfully making such transfers. Companies that violate the GDPR can face private litigation, restrictions, or prohibitions on data processing, and fines of up to the greater of 20 million Euros (17.5 million GBP for the UK) or 4% of worldwide annual revenue.

Previous wording

In addition, further to the UK’s exit from the EU on January 31, 2020, the GDPR ceased to apply in the UK at the end of the transition period on December 31, 2020 however, the UK’s European Union (Withdrawal) Act 2018 incorporated the GDPR (as it existed on December 31, 2020 but subject to certain UK specific amendments) into UK law, referred to as the UK GDPR. The UK GDPR and the UK Data Protection Act 2018 set out the UK’s data protection regime, which is independent from but aligned to the EU’s data protection regime. Non-compliance with the UK GDPR may result in monetary penalties of up to £17.5 million or 4% of worldwide revenue, whichever is higher. Although the GDPR and the UK GDPR currently impose substantially similar obligations, it is possible that over time the UK GDPR could become less aligned with the GDPR. The UK government has announced plans to reform the data protection legal framework in the UK in its Data Reform Bill, which will introduce significant changes from the GDPR. This may lead to additional compliance costs and could increase our overall risk exposure as we may no longer be able to take a unified approach across the EEA and the UK. This lack of clarity on future UK laws and regulations and their interaction with EU laws and regulations could add legal risk, uncertainty, complexity and cost to our handling of EU personal information and our privacy and data security compliance programs and could require us to implement different compliance measures for the UK and the EU.

Current wording

Although the EU GDPR and the UK GDPR currently impose substantially similar obligations, it is possible that over time the UK GDPR could become less aligned with the EU GDPR. The UK government has announced plans to reform the data protection legal framework in the UK in its Data Reform Bill, which will introduce significant changes from the EU GDPR. This may lead to additional compliance costs and could increase our overall risk exposure as we may no longer be able to take a unified approach across the EEA and the UK. This lack of clarity on future UK laws and regulations and their interaction with EU laws and regulations could add legal risk, uncertainty, complexity and cost to our handling of EU personal information and our privacy and data security compliance programs and could require us to implement different compliance measures for the UK and the EU.

Previous wording

Although the UK is regarded as a third country under the EU’s GDPR, the European Commission (the “EC”), has now issued a decision recognizing the UK as providing adequate protection under the EU GDPR and, therefore, transfers of personal data originating in the EU to the UK remain unrestricted. Like the EU GDPR, the UK GDPR restricts personal data transfers outside the UK to countries not regarded by the UK as providing adequate protection. The UK government has confirmed that personal data transfers from the UK to the EEA remain free flowing. To enable the transfer of personal data outside of the EEA or the UK, adequate safeguards must be implemented in compliance with European and UK data protection laws, such as the Standard Contractual Clauses (SCCs) published by the European Commission, binding corporate rules or certification to the EU-U.S. Data Privacy Framework that the European Commission adopted on July 10, 2023. The UK is not subject to the EC’s SCCs but has published the UK International Data Transfer Agreement and International Data Transfer Addendum to the new standard contractual clauses (the “IDTA”), which enable transfers from the UK. For new transfers, the IDTA already needs to be in place, and must be in place for all existing transfers from the UK from March 21, 2024. Following a ruling from the Court of Justice of the EU, in Data Protection Commissioner v Facebook Ireland Limited and Maximillian Schrems, Case C-311/18 ("Schrems II"), companies relying on SCCs to govern transfers of personal data to third countries (in particular the United States) will need to assess whether the data importer can ensure sufficient guarantees for safeguarding the personal data under GDPR. This assessment includes assessing whether third-party vendors can also ensure these guarantees. The same assessment is required for transfers governed by the IDTA. We will be required to implement these new safeguards when conducting restricted data transfers under the GDPR and doing so will require significant effort and cost.

Current wording

Although the UK is regarded as a third country under the EU’s GDPR, the European Commission (the “EC”), has now issued a decision recognizing the UK as providing adequate protection under the EU GDPR and, therefore, transfers of personal data originating in the EU to the UK remain unrestricted. Like the EU GDPR, the UK GDPR restricts personal data transfers outside the UK to countries not regarded by the UK as providing adequate protection. The UK government has confirmed that personal data transfers from the UK to the EEA remain free flowing.

Previous wording

Our operations have consumed substantial amounts of cash since inception and we intend to continue to make significant investments to support our business growth, respond to business challenges or opportunities, develop new applications and services, enhance our existing solution and services, enhance our operating infrastructure and potentially acquire complementary businesses and technologies. For the three months ended April 30, 2024 our net cash used in operating activities was $0.7 million. As of April 30, 2024, we had $79.5 million of cash and cash equivalents, which are held for working capital purposes. As of April 30, 2024 and January 31, 2024, we had no outstanding borrowings under the Capital One Credit Facility, with the ability to borrow up to $50.0 million.

Current wording

Our operations have consumed substantial amounts of cash since inception and we intend to continue to make significant investments to support our business growth, respond to business challenges or opportunities, develop new applications and services, enhance our existing solution and services, enhance our operating infrastructure and potentially acquire complementary businesses and technologies. For the six months ended July 31, 2024 our net cash provided by operating activities was $10.3 million. As of July 31, 2024, we had $81.8 million of cash and cash equivalents, which are held for working capital purposes. As of July 31, 2024 and January 31, 2024, we had no outstanding borrowings under the Capital One Credit Facility, with the ability to borrow up to $50.0 million.

Previous wording

Adverse developments that affect financial institutions, transactional counterparties or other third parties, or concerns or rumors about any events of these kinds or other similar risks, have in the past and may in the future lead to market-wide liquidity problems.

Current wording

Adverse developments that affect financial institutions, transactional counterparties or other third parties, or concerns or rumors about any events of these kinds or other similar risks, have in the past and may in the future lead to market-wide liquidity problems. For example, in early 2023, several financial institutions closed and were taken into receivership by the Federal Deposit Insurance Corporation (“FDIC”).

Previous wording

Widespread investor concerns regarding the U.S. or international financial systems could also result in less favorable commercial financing terms, including higher interest rates or costs and tighter financial and operating covenants, or systemic limitations on access to credit and liquidity sources, thereby making it more difficult for us to acquire financing on acceptable terms or at all. Any decline in available funding or access to our cash and liquidity resources could, among other risks, adversely impact our ability to meet our operating expenses, financial obligations or fulfill our other obligations, result in breaches of our financial and/or contractual obligations or result in violations of federal or state wage and hour laws. Any of these impacts, or any other impacts resulting from the factors described above or other related or similar factors not described above, could have material adverse impacts on our liquidity and our current and/or projected business operations and financial condition and results of operations.

Current wording

Although we assess our banking relationships as we believe necessary or appropriate, our access to cash in amounts adequate to finance or capitalize our current and projected future business operations could be significantly impaired by factors that affect us, the financial institutions with which we have banking relationships, or the financial services industry or economy in general. Further, investor concerns regarding domestic or international financial systems could result in less favorable commercial financing terms, including higher interest rates or costs and tighter financial and operating covenants, or systemic limitations on access to credit and liquidity sources, thereby making it more difficult for us to acquire financing on acceptable terms or at all. Any decline in available funding or access to cash and liquidity resources could, among other risks, adversely impact our ability to meet our financial obligations, which could have material adverse impacts on our liquidity and our business, financial condition, or results of operations.