Phreesia, Inc.

Previous wording

In addition, to manage our current and anticipated future growth effectively, we must continue to maintain and enhance our IT infrastructure, financial and accounting systems and controls and continue to build our qualified workforce in key areas of our company. A key element of how we manage our growth is our ability to scale our capabilities and satisfactorily implement solutions for our clients’ needs. Our healthcare services clients often require specific features or functions unique to their organizational structure, which, at a time of significant growth or during periods of high demand, may strain our implementation capacity and hinder our ability to successfully implement our solutions for our clients in a timely manner. If we are unable to address the needs of our healthcare services clients or our healthcare services clients are unsatisfied with the quality of our solutions or our services due to our inability to manage our rapid growth, they may not renew their contracts, seek to cancel or terminate their relationship with us or renew on less favorable terms, any of which could adversely affect our business. Additionally, our ability to grow our financing business is in part dependent on our access to capital for the securitization of cardholder receivables. If we are unable to maintain or expand our access to capital on favorable terms or at all, we may be unable to offer our financing solutions to a greater number of existing or potential healthcare services clients.

Current wording

In addition, to manage our current and anticipated future growth effectively, we must continue to maintain and enhance our IT infrastructure, financial and accounting systems and controls and continue to build our qualified workforce in key areas of our company. A key element of how we manage our growth is our ability to scale our capabilities and satisfactorily implement solutions for our clients’ needs. Our healthcare services clients often require specific features or functions unique to their organizational structure, which, at a time of significant growth or during periods of high demand, may strain our implementation capacity and hinder our ability to successfully implement our solutions for our clients in a timely manner. If we are unable to address the needs of our healthcare services clients or our healthcare services clients are unsatisfied with the quality of our solutions or our services due to our inability to manage our rapid growth, they may not renew their contracts, seek to cancel or terminate their relationship with us or renew on less favorable terms, any of which could adversely affect our business.

Previous wording

Regulation P and the FTC Safeguards Rule, as well as the FTC’s Identity Theft Red Flags Rule under the Fair Credit Reporting Act, which, among other things, require financial institutions to explain their information sharing practices to their customers, safeguard sensitive data and maintain an identity theft prevention program. We may be required to expend significant capital and other resources to ensure ongoing compliance with applicable privacy and data security laws and regulatory requirements. Claims that we have violated individuals’ privacy rights, violated applicable privacy laws and regulations or breached our contractual obligations, even if we are not found liable, could be expensive and time-consuming to defend and could result in adverse publicity that could harm our business, or enforcement and other supervisory actions. Our contracts may not contain limitations of liability, and even where they do, there can be no assurance that limitations of liability in our contracts are sufficient to protect us from liabilities, damages, or claims related to our privacy and data security obligations. Further, although we maintain cyber liability insurance, this insurance may not provide adequate coverage against potential liabilities related to any experienced cybersecurity incident or breach.

Current wording

We are subject to state laws requiring notification of affected individuals and state regulators in the event of a cybersecurity incident or breach of personal information. Furthermore, certain health privacy laws, data breach notification laws, consumer protection laws and genetic testing laws may apply directly to our business and/or those of our collaborators and may impose restrictions on our collection, use and dissemination of individuals’ health information. Patients about whom we obtain health information, as well as the healthcare services clients who share this information with us, may have statutory or contractual rights that limit our ability to use and disclose the information. Additionally, our subsidiary, AccessOne MedCard, Inc. (“AccessOne MedCard”) is subject to regulation and supervision of cybersecurity and data privacy matters by state and federal regulators, including state financial regulatory agencies, the FTC and the CFPB, including the NYDFS Part 500 Requirements, and the GLBA and Regulation P and the FTC Safeguards Rule, as well as the FTC’s Identity Theft Red Flags Rule under the Fair Credit Reporting Act, which, among other things, require financial institutions to explain their information sharing practices to their customers, safeguard sensitive data and maintain an identity theft prevention program. We may be required to expend significant capital and other resources to ensure ongoing compliance with applicable privacy and data security laws and regulatory requirements. Claims that we have violated individuals’ privacy rights, violated applicable privacy laws and regulations or breached our contractual obligations, even if we are not found liable, could be expensive and time-consuming to defend and could result in adverse publicity that could harm our business, or enforcement and other supervisory actions. Our contracts may not contain limitations of liability, and even where they do, there can be no assurance that limitations of liability in our contracts are sufficient to protect us from liabilities, damages, or claims related to our privacy and data security obligations. Further, although we maintain cyber liability insurance, this insurance may not provide adequate coverage against potential liabilities related to any experienced cybersecurity incident or breach.

Previous wording

We have incurred significant operating losses for most of our history. For the three months ended April 30, 2026 and the years ended January 31, 2026 and January 31, 2025, we had net income of $3.0 million and $2.3 million and net loss of $58.5 million, respectively, and income from operations of $6.7 million and losses from operations of $6.6 million and $58.1 million, respectively. Our operating expenses may increase in the foreseeable future as we continue to invest to grow our business, including through acquisitions, and build relationships with our clients and partners, develop new solutions and operate as a public company. In addition, to the extent we are successful in increasing our client base, we could incur increased losses because significant costs associated with entering into client agreements are generally incurred up front, while revenue is generally recognized ratably over the term of the agreement. As a result, we may need to raise additional capital through equity and debt financings in order to fund our operations, which may not be available to us on favorable terms or at all. If we are unable to effectively manage these risks and difficulties as we encounter them or effectively access the capital markets, our business, financial condition and results of operations may suffer.

Current wording

We have incurred significant operating losses for most of our history. For the three and six months ended July 31, 2026 and the years ended January 31, 2026 and January 31, 2025, we had net income of $1.9 million, $4.9 million and $2.3 million and net loss of $58.5 million, respectively, and income from operations of $7.6 million and $14.4 million and losses from operations of $6.6 million and $58.1 million, respectively. Our operating expenses may increase in the foreseeable future as we continue to invest to grow our business, including through acquisitions, and build relationships with our clients and partners, develop new solutions and operate as a public company. In addition, to the extent we are successful in increasing our client base, we could incur increased losses because significant costs associated with entering into client agreements are generally incurred up front, while revenue is generally recognized ratably over the term of the agreement. As a result, we may need to raise additional capital through equity and debt financings in order to fund our operations, which may not be available to us on favorable terms or at all. If we are unable to effectively manage these risks and difficulties as we encounter them or effectively access the capital markets, our business, financial condition and results of operations may suffer.

Previous wording

In May 2026, we implemented a restructuring plan intended to reduce operating expenses and better align our cost structure with our current business priorities. The plan included the elimination of approximately 220 positions, approximately half of which are contractor roles. Completion of the restructuring plan may have continuing adverse effects on our workforce, including negative effects on employee morale, increased employee attrition, increased difficulty in hiring new employees, and diversion of management attention. Additionally, as we are operating our business with fewer employees, we face additional risks that we might not be able to execute on our strategic plans and product roadmap, which may have an adverse effect on our business, financial condition, and operating results.

Current wording

In May 2026, we implemented a restructuring plan intended to reduce operating expenses and better align our cost structure with our current business priorities. The plan includes the elimination of approximately 220 positions, approximately half of which are contractor roles. Completion of the restructuring plan may have continuing adverse effects on our workforce, including negative effects on employee morale and our reputation with current or prospective employees, increased employee attrition, increased difficulty in hiring new employees, loss of institutional knowledge and expertise and diversion of management attention. Additionally, as we are operating our business with fewer employees, we face additional risks that we might not be able to execute on our strategic plans and product roadmap, which may have an adverse effect on our business, financial condition, and operating results. We may also not realize, in full or in part, the anticipated benefits and savings from the restructuring due to inaccurate plan estimates and forecasts, changing market conditions, unforeseen difficulties, delays or unexpected costs. If we are unable to realize the expected operational efficiencies and cost savings from the restructuring plan, our operating results and financial condition could be adversely affected.

Previous wording

We believe that there are significant benefits that may be realized through the AccessOne Acquisition. However, the efforts to realize these benefits is a complex process and may disrupt both companies’ existing operations if not implemented in a timely and efficient manner. The integration may be more difficult, costly or time-consuming than expected. We have incurred substantial expenses in connection with the AccessOne Acquisition, including legal, financial advisory, accounting, consulting, and other advisory fees, employee benefit-related costs, filing fees and other regulatory fees, closing, integration and other related costs. The anticipated benefits of the AccessOne

Current wording

We believe that there are significant benefits that may be realized through the AccessOne Acquisition. However, the efforts to realize these benefits is a complex process and may disrupt both companies’ existing operations if not implemented in a timely and efficient manner. The integration may be more difficult, costly or time-consuming than expected. We have incurred substantial expenses in connection with the AccessOne Acquisition, including legal, financial advisory, accounting, consulting, and other advisory fees, employee benefit-related costs, filing fees and other regulatory fees, closing, integration and other related costs. The anticipated benefits of the AccessOne Acquisition, including anticipated sales or growth opportunities and cross-selling opportunities, may not be realized as expected or may not be achieved within the anticipated time frame or at all. In addition, we are required to devote significant attention and resources to successfully integrate the operations of the acquired business. This process may disrupt the businesses and, if ineffective, would limit the anticipated benefits of the AccessOne Acquisition.

Previous wording

Our payment processing platform is a core element of our business. For the three months ended April 30, 2026 and the fiscal year ended January 31, 2025, our payment processing fees generated 32% and 24% of our total revenue, respectively. Our future success depends in part on the continued growth and development of our payment processing platform. If such activities are limited, restricted, curtailed or degraded in any way, or if we fail to continue to grow and develop our payment processing platform, our business may be materially and adversely affected. The utilization of our payment processing tools may be impacted by factors outside of our control, such as changes in laws governing medical bill payments or disruptions in the payment processing industry generally. If the number of patients utilizing our payments platform, the aggregate amounts paid by such patients directly to our healthcare services clients through our payments platform, or the credit card interchange fees we receive from such payments were to be reduced as a result of disruptions in the payment processing industry, laws discouraging the use of credit card payments for medical services or other factors, it could result in a decrease to our revenue. In addition, some potential or existing clients may not desire to use our payment processing services or to switch from their existing payment processing vendors for a variety of reasons, such as transition costs, business disruption, and loss of accustomed functionality. There can be no assurance that our efforts to overcome these factors will be successful, and this resistance may adversely affect our growth.

Current wording

Our payment processing platform is a core element of our business. For the three and six months ended July 31, 2026 and the fiscal year ended January 31, 2026, our payment processing fees generated 23%,24% and 24% of our total revenue, respectively. Our future success depends in part on the continued growth and development of our payment processing platform. If such activities are limited, restricted, curtailed or degraded in any way, or if we fail to continue to grow and develop our payment processing platform, our business may be materially and adversely affected. The utilization of our payment processing tools may be impacted by factors outside of our control, such as changes in laws governing medical bill payments or disruptions in the payment processing industry generally. If the number of patients utilizing our payments platform, the aggregate amounts paid by such patients directly to our healthcare services clients through our payments platform, or the credit card interchange fees we receive from such payments were to be reduced as a result of disruptions in the payment processing industry, laws discouraging the use of credit card payments for medical services or other factors, it could result in a decrease to our revenue. In addition, some potential or existing clients may not desire to use our payment processing services or to switch from their existing payment processing vendors for a variety of reasons, such as transition costs, business disruption, and loss of accustomed functionality. There can be no assurance that our efforts to overcome these factors will be successful, and this resistance may adversely affect our growth.

Previous wording

With respect to certain of our solutions, we are a “business associate as defined under HIPAA. The U.S. Department of Health and Human Services (“HHS”) Office for Civil Rights may impose civil penalties on a business associate for a failure to comply with HIPAA requirements. The U.S. Department of Justice is responsible for criminal prosecutions under HIPAA. Penalties can vary significantly depending on a number of factors, such as whether the business associate’s failure to comply was due to willful neglect. State attorneys general also have the right to prosecute HIPAA violations in their states. While HIPAA does not create a private right of action that would allow individuals to sue in civil court, its standards have been used as the basis for the duty of care in state civil suits, such as those for recklessness in misusing individuals’ health information. If we are subject to investigation or litigation related to an alleged violation of HIPAA, such as the ConnecOnCall case, then we may elect to resolve the matter through a settlement. Such settlement could require payment of a civil penalty or damages, corrective action and/or monitoring of our business by a third party.

Current wording

With respect to certain of our solutions, we are a “business associate as defined under HIPAA. The U.S. Department of Health and Human Services (“HHS”) Office for Civil Rights may impose civil penalties on a business associate for a failure to comply with HIPAA requirements. The U.S. Department of Justice is responsible for criminal prosecutions under HIPAA. Penalties can vary significantly depending on a number of factors, such as whether the business associate’s failure to comply was due to willful neglect. State attorneys general also have the right to prosecute HIPAA violations in their states. While HIPAA does not create a private right of action that would allow individuals to sue in civil court, its standards have been used as the basis for the duty of care in state civil suits, such as those for recklessness in misusing individuals’ health information. If we are subject to investigation or litigation related to an alleged violation of HIPAA, such as the ConnectOnCall case, then we may elect to resolve the matter through a settlement. Such settlement could require payment of a civil penalty or damages, corrective action and/or monitoring of our business by a third party.

Previous wording

We expect that there will continue to be new or amended laws, regulations, standards and obligations proposed and enacted in various foreign jurisdictions. Many countries around the world have enacted comprehensive privacy and data protection laws that can impact our business. Some of the businesses we have acquired are subject to additional laws and regulations in jurisdictions outside of the U.S. For example, in Europe, organizations that collect or otherwise process personal data in connection with (a) the activities of a business establishment within the European Economic Area/United Kingdom; or (b) offering goods or services to/monitoring the behavior of individuals within these territories are subject to the EU General Data Protection Regulation, or EU GDPR, and the EU GDPR as incorporated into the laws of the United Kingdom following Brexit (“UK GDPR”, together with the EU GDPR, “GDPR”). The GDPR, alongside supplementary local data protection laws in the EU and the UK, impose stringent requirements on the processing of personal data, with heightened obligations for health and other sensitive data. These requirements include: (i) providing information to individuals regarding data processing activities; (ii) ensuring a legal basis or condition applies to the processing of personal data and, where applicable, obtaining consent from individuals to whom the data processing relates; (iii) responding to data subject requests; (iv) imposing requirements to notify the competent national data protection authorities and data subjects of personal data breaches; (v) implementing safeguards in connection with the security and confidentiality of the personal data; (vi) accountability requirements; and (vii) taking certain measures when engaging third-party processors. The GDPR also restricts the transfer of personal data to countries outside of the EEA/UK that do not ensure an adequate level of protection, including the United States in certain circumstances, unless a valid transfer mechanism is in place, and where required, a transfer impact assessment has been completed. Compliance with such laws and regulations, including any new or evolving regulations relating to the use of data in AI and machine learning technologies, such as the EU AI Act, requires resources and could be more costly and take more time than we anticipate, and could involve regulatory investigations, fines (which under the GDPR can be substantial), or other penalties for non-compliance, all of which could adversely affect our business.

Current wording

We expect that there will continue to be new or amended laws, regulations, standards and obligations proposed and enacted in various foreign jurisdictions. Many countries around the world have enacted comprehensive privacy and data protection laws that can impact our business. Some of the businesses we have acquired are subject to additional laws and regulations in jurisdictions outside of the U.S. For example, in Europe, organizations that collect or otherwise process personal data in connection with (a) the activities of a business establishment within the European Economic Area/United Kingdom; or (b) offering goods or services to/monitoring the behavior of individuals within these territories are subject to the EU General Data Protection Regulation, or EU GDPR, and the EU GDPR as incorporated into the laws of the United Kingdom following Brexit (“UK GDPR”, together with the EU GDPR, “GDPR”). The GDPR, alongside supplementary local data protection laws in the EU and the UK, impose stringent requirements on the processing of personal data, with heightened obligations for health and other sensitive data. These requirements include: (i) providing information to individuals regarding data processing activities; (ii) ensuring a legal basis or condition applies to the processing of personal data and, where applicable, obtaining consent from individuals to whom the data processing relates; (iii) responding to data subject requests; (iv) imposing requirements to notify the competent national data protection authorities and data subjects of personal data breaches; (v) implementing safeguards in connection with the security and confidentiality of the personal data; (vi) accountability requirements; and (vii) taking certain measures when engaging third-party processors. The GDPR also restricts the transfer of personal data to countries outside of the EEA/UK that do not ensure an adequate level of protection, including the United States in certain circumstances, unless a valid transfer mechanism is in place, and where required, a transfer impact assessment has been completed. Compliance with such laws and regulations requires resources and could be more costly and take more time than we anticipate, and could involve regulatory investigations, fines (which under the GDPR can be substantial), or other penalties for non-compliance, all of which could adversely affect our business.

Previous wording

We rely on a variety of direct marketing techniques, including email marketing. These activities are regulated by legislation such as the Controlling the Assault of Non-Solicited Pornography and Marketing Act of 2003 (“CAN-SPAM Act”). Any failure by us to comply fully with the CAN-SPAM Act may leave us subject to substantial fines and penalties. In addition, any future restrictions in laws such as the CAN-SPAM Act, and various United States state laws, or new federal laws regarding marketing and solicitation or international data protection laws that govern these activities could adversely affect the continuing effectiveness of our marketing efforts and could force changes in our marketing strategies. If this occurs, we may not be able to develop adequate alternative marketing strategies, which could have a material adverse impact on our results of operations.

Current wording

We rely on a variety of direct marketing techniques, including email marketing. These activities are regulated by legislation such as the Controlling the Assault of Non-Solicited Pornography and Marketing Act of 2003 (“CAN-SPAM Act”). Any failure by us to comply fully with the CAN-SPAM Act may leave us subject to substantial fines and penalties. In addition, any future restrictions in laws such as the CAN-SPAM Act, and various United States state laws, or new federal laws regarding marketing and solicitation or international privacy laws that govern these activities could adversely affect the continuing effectiveness of our marketing efforts and could force changes in our marketing strategies. If this occurs, we may not be able to develop adequate alternative marketing strategies, which could have a material adverse impact on our results of operations.

Previous wording

Additionally, our subsidiary, AccessOne MedCard offers medical financing products, which are subject to extensive and evolving federal and state consumer protection, fair lending and other laws and regulations. In recent years, the CFPB and various state attorneys general have increased scrutiny of third-party providers of financing for medical services, and have conducted investigations and brought enforcement actions alleging abusive or otherwise improper lending practices. Heightened scrutiny of, or any additional laws, rules or regulations applicable to, third-party medical financing arrangements could result in increased administrative and compliance costs, exposure to governmental investigations, enforcement actions, fines, penalties or private litigation, and require AccessOne MedCard to modify or limit its products and marketing practices, reducing its ability to participate competitively in this market. It is possible that governmental authorities will conclude that our business practices do not comply with current or future statutes, regulations, agency guidance or case law involving applicable fraud and abuse or other healthcare laws and regulations. If our operations are found to be in violation of any of the laws described above or any other governmental laws and regulations that may apply to us, we may be subject to significant penalties, including administrative, civil and criminal penalties, damages, fines, disgorgement, the exclusion from participation in federal and state healthcare programs, individual imprisonment, reputational harm, and the curtailment or restructuring of our operations, as well as additional reporting obligations and oversight if we become subject to a corporate integrity agreement or other agreement to resolve allegations of non-compliance with these laws. Likewise, if any of the healthcare providers or entities with whom we do business are found to not be in compliance with applicable laws, they may be subject to criminal, civil or administrative sanctions, including exclusions from government funded healthcare programs and imprisonment. Further, defending against any such actions can be costly and time consuming, and may require significant financial and personnel resources. Therefore, even if we are successful in defending against any such actions that may be brought against us, our business may be impaired. If any of the above occur, our ability to operate our business and our results of operations could be adversely affected.

Current wording

Additionally, our subsidiary, AccessOne MedCard offers financing products used to pay for medical services, which are subject to extensive and evolving federal and state consumer protection, fair lending and other laws and regulations. In recent years, the CFPB and various state attorneys general have increased scrutiny of third-party providers of financing for medical services, and have conducted investigations and brought enforcement actions alleging abusive or otherwise improper lending practices. Heightened scrutiny of, or any additional laws, rules or regulations applicable to, third-party medical financing arrangements could result in increased administrative and compliance costs, exposure to governmental investigations, enforcement actions, fines, penalties or private litigation, and require AccessOne MedCard to modify or limit its products and marketing practices, reducing its ability to participate competitively in this market. It is possible that governmental authorities will conclude that our business practices do not comply with current or future statutes, regulations, agency guidance or case law involving applicable fraud and abuse or other healthcare laws and regulations. If our operations are found to be in violation of any of the laws described above or any other governmental laws and regulations that may apply to us, we may be subject to significant penalties, including administrative, civil and criminal penalties, damages, fines, disgorgement, the exclusion from participation in federal and state healthcare programs, individual imprisonment, reputational harm, and the curtailment or restructuring of our operations, as well as additional reporting obligations and oversight if we become subject to a corporate integrity agreement or other agreement to resolve allegations of non- compliance with these laws. Likewise, if any of the healthcare providers or entities with whom we do business are found to not be in compliance with applicable laws, they may be subject to criminal, civil or administrative sanctions, including exclusions from government funded healthcare programs and imprisonment. Further, defending against any such actions can be costly and time consuming, and may require significant financial and personnel resources. Therefore, even if we are successful in defending against any such actions that may be brought against us, our business may be impaired. If any of the above occur, our ability to operate our business and our results of operations could be adversely affected.

Previous wording

Developments in AI have impacted the software industry and we may expect this impact to continue. AI has become increasingly prevalent in the markets in which we operate and may result in changes in the demand for our solutions, including, but not limited to, reducing the difficulty and cost for competitors to build and launch competitive products or by making aspects of our solutions obsolete. Our competitive position could be harmed if we fail to adopt and integrate AI, including generative AI, effectively into our operations and product offerings. The successful implementation of AI technologies requires significant investment in talent, infrastructure, and ongoing research and development. While we have made, and expect to continue to make, significant investments to integrate AI into our solutions and operations, AI technologies are rapidly evolving and there can be no guarantee that our solutions will remain competitive as new AI technologies are developed and adopted. Market acceptance, understanding, and valuation and consumer perceptions of platforms, products and programs that incorporate AI technologies is uncertain, and the perceived value of AI technologies could be inaccurate. Developing, testing and deploying AI systems may also increase the cost profile of our solutions due to the nature of the computing costs involved in such systems. Misjudging the convergence of AI with our business needs may lead to inefficiencies or obsolescence of our services or solutions.

Current wording

Developments in AI have impacted the software industry and we may expect this impact to continue. AI has become increasingly prevalent in the markets in which we operate and may result in changes in the demand for our solutions, including, but not limited to, reducing the difficulty and cost for competitors to build and launch competitive products, enabling healthcare providers to develop or adopt in-house AI-enabled tools that perform functions currently served by our platform, or by making aspects of our solutions obsolete. As AI-enabled workflow automation, patient engagement and scheduling tools become more widely available, our healthcare services clients or their EHR and PM system vendors may choose to replace or reduce their use of our solutions in favor of lower-cost or integrated alternatives, which could adversely affect client retention, pricing and demand for our subscription and related services. Our competitive position could be harmed if we fail to adopt and integrate AI, including generative AI, effectively into our operations and product offerings. The successful implementation of AI technologies requires significant investment in talent, infrastructure, and ongoing research and development. While we have made, and expect to continue to make, significant investments to integrate AI into our solutions and operations, AI technologies are rapidly evolving and there can be no guarantee that our solutions will remain competitive as new AI technologies are developed and adopted. Market acceptance, understanding, and valuation and consumer perceptions of platforms, products and programs that incorporate AI technologies is uncertain, and the perceived value of AI technologies could be inaccurate. Developing, testing and deploying AI systems may also increase the cost profile of our solutions due to the nature of the computing costs involved in such systems. Misjudging the convergence of AI with our business needs may lead to inefficiencies or obsolescence of our services or solutions.

Previous wording

Additionally, our employees, vendors and third-party partners could use AI to perform their work. Certain of our vendors incorporate AI tools into their offerings, and the providers of these AI tools may not meet existing or rapidly evolving regulatory or industry standards, including with respect to privacy and data security. If we, our vendors, or our third-party partners experience an actual or perceived data breach or cybersecurity incident because of the use of generative AI, we may lose valuable intellectual property, personal data and/or confidential information, and our reputation and the public perception of the effectiveness of our security measures could be harmed. Further, bad actors around the world use increasingly sophisticated methods, including the use of AI, to engage in illegal activities involving the theft and misuse of personal information, confidential information, and intellectual property. In addition, the use of generative AI models in our internal or third-party systems may create new attack surfaces or methods for adversaries, which could impact us and our vendors. Any of these outcomes could damage our reputation, subject us to legal liability, result in the loss of valuable property and information, and adversely impact our business.

Current wording

Additionally, our employees, vendors and third-party partners could use AI to perform their work. Our workforce uses AI technologies in connection with certain business functions, and we have policies governing their authorized use. Nevertheless, employees may use unauthorized or ungoverned AI applications outside of established governance and security controls, resulting in sensitive customer or business data being transmitted to third-party platforms in ways that are inconsistent with our privacy and data protection obligations. Our ability to mitigate these risks depends on our continued training, monitoring, and enforcement of policies governing employee AI use. Additionally, certain of our vendors incorporate AI tools into their offerings, and the providers of these AI tools may not meet existing or rapidly evolving regulatory or industry standards, including with respect to privacy and data security. Our use, and the use by our vendors and third-party partners, of AI technologies to process protected health information, personal data or other sensitive information may also create additional compliance risks under federal and state health information privacy and security laws. For example, the use of such information to develop, train, test, evaluate or improve AI models, or the disclosure of such information to third-party AI providers, could be subject to restrictions on the use and disclosure of such information and other contractual or regulatory requirements. If we, our vendors, or our third-party partners experience an actual or perceived data breach or cybersecurity incident because of the use of generative AI, we may lose valuable intellectual property, personal data and/or confidential information, and our reputation and the public perception of the effectiveness of our security measures could be harmed. Further, bad actors around the world use increasingly sophisticated methods, including the use of AI, to engage in illegal activities involving the theft and misuse of personal information, confidential information, and intellectual property. In addition, the use of generative AI models in our internal or third-party systems may create new attack surfaces or methods for adversaries, which could impact us and our vendors. Any of these outcomes could damage our reputation, subject us to legal liability, result in the loss of valuable property and information, and adversely impact our business.

Previous wording

A growing number of legislators and regulators are adopting laws and regulations and have focused enforcement efforts on the adoption of artificial intelligence and the use of such technologies in compliance with ethical standards and societal expectations. In the U.S., the AI regulatory environment is complex and uncertain. use of AI in compliance with ethical standards and societal expectations. These developments may increase our compliance burden and costs in connection with the use of AI and lead to legal liability if we fail to meet evolving legal standards or if use of such technologies results in harms or other causes of action we did not predict. For example, the EU began implementing the Artificial Intelligence Act (the “AI Act”) on August 1, 2024, with a significant part of the law scheduled to come into effect in August 2026. As currently enacted, the AI Act, which may be amended as part of the EU’s Digital Omnibus, imposes significant obligations on providers and deployers of high-risk artificial intelligence systems, and encourages providers and deployers of artificial intelligence systems to account for EU ethical principles in their development and use of these systems. The scope of requirements depends on judicial interpretations and forthcoming legislative amendments, and non-compliance can lead to significant fines. In the United States, the AI regulatory environment is complex and uncertain. Over the past year, states have advanced, and in some cases passed, dozens of laws focusing on AI governance and regulation, including on deployment of AI in healthcare settings. At the federal level, the Trump Administration has endorsed a federal moratorium on the enforcement of state AI laws, including through a December 11, 2025 executive order, “Ensuring a National Policy Framework for Artificial Intelligence.” So far, these efforts have not been successful at curtailing state action on AI regulation, contributing to a complicated legislative patchwork, which may be litigated in state and federal courts. If we develop or use AI systems that are governed by these laws or regulations, we will need to meet higher standards of data quality, transparency, and human oversight, and we would need to adhere to specific and potentially burdensome and costly ethical, accountability, and administrative requirements. We may also be subject to significant enforcement or litigation in the event of any perceived non-compliance.

Current wording

For example, the EU’s Artificial Intelligence Act (the “AI Act”) entered into force on August 1, 2024. Certain provisions have already become applicable, including the prohibitions on certain AI practices and obligations relating to general-purpose AI models. Most remaining provisions apply from August 2, 2026, although the application of certain rules for high-risk AI systems have been deferred until December 2, 2027 (or, for certain product-embedded AI systems, August 2, 2028). The AI Act, as recently amended by the EU’s Digital Omnibus on AI, imposes significant obligations on providers and deployers of high-risk artificial intelligence systems, and encourages providers and deployers of artificial intelligence systems to account for EU ethical principles in their development and use of these systems. The scope of requirements depends on judicial interpretations and forthcoming legislative amendments, and non-compliance can lead to significant fines. In the United States, the AI regulatory environment is complex and uncertain. Over the past year, states have advanced, and in some cases passed, dozens of laws focusing on AI governance and regulation, including on deployment of AI in healthcare settings. At the federal level, the Trump Administration has endorsed a federal moratorium on the enforcement of state AI laws, including through a December 11, 2025 executive order, “Ensuring a National Policy Framework for Artificial Intelligence.” So far, these efforts have not been successful at curtailing state action on AI regulation, contributing to a complicated legislative patchwork, which may be litigated in state and federal courts. If we develop or use AI systems that are governed by these laws or regulations, we will need to meet higher standards of data quality, transparency, and human oversight, and we would need to adhere to specific and potentially burdensome and costly ethical, accountability, and administrative requirements. We may also be subject to significant enforcement or litigation in the event of any perceived non-compliance.

Previous wording

The rapid evolution of AI will require the application of significant resources to help ensure that AI is implemented in accordance with applicable law and regulation and in a socially responsible manner and to minimize any real or perceived unintended harmful impacts. Use of this technology could pose cybersecurity, data privacy, IT, intellectual property, regulatory, legal, operational, competitive, reputational and other risks and challenges that could affect our business. Specifically, AI systems can present risks related to accuracy, bias, errors, discrimination, harmful content, misinformation, fraud, scams, targeted attacks (including model poisoning or data poisoning), surveillance, data leakage, inequality, environmental harms, false or “hallucinatory” inferences or outputs, and other harms may flow from our development, use, or deployment of AI technologies. For example, if the content, analyses, or recommendations that AI systems assist in producing are, or are alleged or perceived to be inaccurate, deficient, or biased, our reputation, competitive position, business, financial condition, and results of operations may be adversely affected. The use of certain AI technologies can also give rise to intellectual property risks, including by disclosing or otherwise compromising our confidential or proprietary intellectual property, or by undermining our ability to assert or defend ownership rights in intellectual property created with the assistance of AI tools. Any of these effects could damage our reputation, result in the loss of valuable property and information, and adversely impact our business.

Current wording

The rapid evolution of AI will require the application of significant resources to help ensure that AI is implemented in accordance with applicable law and regulation and in a socially responsible manner and to minimize any real or perceived unintended harmful impacts. Use of this technology could pose cybersecurity, data privacy, IT, intellectual property, regulatory, legal, operational, competitive, reputational and other risks and challenges that could affect our business. Specifically, AI systems can present risks related to accuracy, bias, errors, discrimination, harmful content, misinformation, fraud, scams, targeted attacks (including model poisoning or data poisoning), surveillance, data leakage, inequality, environmental harms, false or “hallucinatory” inferences or outputs, and other harms may flow from our development, use, or deployment of AI technologies. In the healthcare context, inaccurate, incomplete, biased or otherwise inappropriate AI-generated outputs could result in incorrect patient communications, inaccurate summaries or analyses of patient information, inappropriate targeting or personalization of communications, errors relating to patient financial responsibility or insurance coverage, or other outcomes that could adversely affect patients or our clients. Depending on the functionality involved, such errors could also cause or contribute to violations of healthcare, privacy, consumer protection, reimbursement, fraud and abuse or other laws and regulations. AI-enabled functionality may also be used by our clients in ways that we do not anticipate or control, potentially exposing us to regulatory scrutiny, litigation, contractual claims or reputational harm even where the applicable regulatory obligation rests primarily with our client. For example, if the content, analyses, or recommendations that AI systems assist in producing are, or are alleged or perceived to be inaccurate, deficient, or biased, our reputation, competitive position, business, financial condition, and results of operations may be adversely affected. The use of certain AI technologies can also give rise to intellectual property risks, including by disclosing or otherwise compromising our confidential or proprietary intellectual property, or by undermining our ability to assert or defend ownership rights in intellectual property created with the assistance of AI tools. Any of these effects could damage our reputation, result in the loss of valuable property and information, subject us to regulatory investigations or enforcement actions, litigation, fines, penalties or restrictions on our products or services, increase our compliance costs and adversely impact our business.

Previous wording

Our future success will depend, in part, on our ability to leverage AI responsibly, effectively and in compliance with laws and regulations. Because AI technology is highly complex and rapidly developing, it is not possible to predict all of the legal, operational. competitive or technological risks that may arise relating to the use of AI.

Current wording

Our future success will depend, in part, on our ability to leverage AI responsibly, effectively and in compliance with laws and regulations. Because AI technology is highly complex and rapidly developing, it is not possible to predict all of the legal, operational, competitive or technological risks that may arise relating to the use of AI. In addition, our public statements, investor presentations, and marketing materials regarding our AI capabilities in our products may be subject to heightened scrutiny by the SEC, investors, or plaintiffs who may allege that our representations were inaccurate or misleading. Any perceived gap between our stated AI capabilities and the operational reality of our products could expose us to regulatory investigations, securities litigation, or reputational harm.

Previous wording

We also depend on our third-party processing partners to perform payment processing services, which generate the majority of our payment solutions revenue. Our processing partners may go out of business or otherwise be unable or unwilling to continue providing such services, which could significantly and materially reduce our payments revenue and disrupt our business. A number of our processing contracts require us to assume liability for any losses our processing partners may suffer as a result of losses caused by our healthcare services clients and their patients, including losses caused by chargebacks and fraud. Thus, in the event of a significant loss by our processing partners, we may be required to pay-out a large amount of cash in one or two business days following such event and, if we do not have sufficient cash on hand, may be deemed in breach of such contracts. A contractual dispute with our processing partners could adversely impact our revenue. Certain contracts may expire or be terminated, and we may not be able to enter into a new payment processor relationship that replicates the associated revenue for a considerable period of time. Further, a portion of our payment solutions revenue is generated through finance charges and servicing fees on cardholder receivables. A portion of these cardholder receivables are sold to an unaffiliated financial institution pursuant to the Securitization Program. If we are unable to maintain the Securitization Program or enter into a new securitization relationship with another third-party financial institution, our financing fees revenue could be adversely affected.

Current wording

We also depend on our third-party processing partners to perform payment processing services, which generate the majority of our payment solutions revenue. Our processing partners may go out of business or otherwise be unable or unwilling to continue providing such services, which could significantly and materially reduce our payments revenue and disrupt our business. A number of our processing contracts require us to assume liability for any losses our processing partners may suffer as a result of losses caused by our healthcare services clients and their patients, including losses caused by chargebacks and fraud. Thus, in the event of a significant loss by our processing partners, we may be required to pay-out a large amount of cash in one or two business days following such event and, if we do not have sufficient cash on hand, may be deemed in breach of such contracts. A contractual dispute with our processing partners could adversely impact our revenue. Certain contracts may expire or be terminated, and we may not be able to enter into a new payment processor relationship that replicates the associated revenue for a considerable period of time. Further, a portion of our payment solutions revenue is generated through finance charges and servicing fees on cardholder receivables. A portion of these cardholder receivables are sold to an unaffiliated financial institution pursuant to AccessOne’s securitization program (the “Securitization Program”). If we are unable to maintain the Securitization Program or enter into a new securitization relationship with another third-party financial institution, our financing fees revenue could be adversely affected.

Previous wording

In addition, we have entered into contracts with providers of EHR and PM solutions, and we intend to pursue such agreements in the future. These contracts are typically structured as commercial and technical agreements, pursuant to which we integrate certain of our solutions into the EHR and PM systems that are utilized by many of our clients, for agreed payments or provision of services to such providers of EHR and PM solutions. Our ability to form and maintain these agreements in order to facilitate the integration of our solutions into the EHR and PM systems used by our healthcare services clients and their patients is important to the success of our business. We or the providers of EHR and PM solutions with which we contract may terminate or seek to amend our agreements in response to future laws or regulations, such as those involving the access, exchange, and use of EHI, or for competitve reasons. If providers of EHR or PM solutions amend, terminate or fail to perform their obligations under their agreements with us, we may need to seek other ways of integrating our solutions with the EHR and PM systems of our healthcare services clients, which could be costly and time consuming, and could adversely affect our business results.

Current wording

In addition, we have entered into contracts with providers of EHR and PM solutions, and we intend to pursue such agreements in the future. These contracts are typically structured as commercial and technical agreements, pursuant to which we integrate certain of our solutions into the EHR and PM systems that are utilized by many of our clients, for agreed payments or provision of services to such providers of EHR and PM solutions. Our ability to form and maintain these agreements in order to facilitate the integration of our solutions into the EHR and PM systems used by our healthcare services clients and their patients is important to the success of our business. We or the providers of EHR and PM solutions with which we contract may terminate or seek to amend our agreements in response to future laws or regulations, such as those involving the access, exchange, and use of EHI, or for competitive reasons. If providers of EHR or PM solutions amend, terminate or fail to perform their obligations under their agreements with us, we may need to seek other ways of integrating our solutions with the EHR and PM systems of our healthcare services clients, which could be costly and time consuming, and could adversely affect our business results.

Previous wording

As of January 31, 2026, we had U.S. federal and state net operating loss carryforwards ("NOLs") of $596.5 million due to prior period losses, which, subject to the following discussion, are generally available to be carried forward to offset a portion of our future taxable income, if any, until such NOLs are used or expire. In general, under Section 382 ("Section 382") of the Internal Revenue Code of 1986, as amended (the "Code"), a corporation that undergoes an “ownership change” is subject to limitations on its ability to utilize its pre-ownership change NOLs to offset future taxable income. Similar rules may apply under state tax laws. We have completed a Section 382 study through January 31, 2026 and as a result of the analysis, identified ownership changes on November 30, 2006, February 2, 2009 and April 30, 2020. The ownership change in 2006 resulted in approximately $316 of NOLs that were generated in 2005 and 2006 that have or will expire unutilized due to Section 382 annual limitations. The ownerhip changes in 2009 and 2020 resulted in limitation of approximately $12,388 and $136,020 NOLs, respectively, but those NOLs are now available to use. Future changes in our stock ownership, some of which are outside of our control, could result in an ownership change under Section 382 of the Code. In addition, under the Tax Cuts and Jobs Act of 2017, as amended by The Coronavirus Aid, Relief, and Economic Security Act of 2020, the amount of post-2017 NOLs that we are permitted to utilize in any taxable year is limited to 80% of our taxable income in such year, where taxable income is determined without regard to the NOL deduction itself. For these reasons, we may not be able to realize a tax benefit from the use of our NOLs. We have a valuation allowance related to our NOLs to recognize only the portion of the deferred tax asset that is more likely than not to be realized.

Current wording

As of January 31, 2026, we had U.S. federal and state net operating loss carryforwards ("NOLs") of $596.5 million due to prior period losses, which, subject to the following discussion, are generally available to be carried forward to offset a portion of our future taxable income, if any, until such NOLs are used or expire. In general, under Section 382 ("Section 382") of the Internal Revenue Code of 1986, as amended (the "Code"), a corporation that undergoes an “ownership change” is subject to limitations on its ability to utilize its pre-ownership change NOLs to offset future taxable income. Similar rules may apply under state tax laws. We have completed a Section 382 study through January 31, 2026 and as a result of the analysis, identified ownership changes on November 30, 2006, February 2, 2009 and April 30, 2020. The ownership change in 2006 resulted in approximately $316 of NOLs that were generated in 2005 and 2006 that have or will expire unutilized due to Section 382 annual limitations. The ownership changes in 2009 and 2020 resulted in limitation of approximately $12,388 and $136,020 NOLs, respectively, but those NOLs are now available to use. Future changes in our stock ownership, some of which are outside of our control, could result in an ownership change under Section 382 of the Code. In addition, under the Tax Cuts and Jobs Act of 2017, as amended by The Coronavirus Aid, Relief, and Economic Security Act of 2020, the amount of post-2017 NOLs that we are permitted to utilize in any taxable year is limited to 80% of our taxable income in such year, where taxable income is determined without regard to the NOL deduction itself. For these reasons, we may not be able to realize a tax benefit from the use of our NOLs. We have a valuation allowance related to our NOLs to recognize only the portion of the deferred tax asset that is more likely than not to be realized.

Previous wording

Our operations have consumed substantial amounts of cash since inception and we intend to continue to make significant investments to support our business growth, respond to business challenges or opportunities, develop new applications and services, enhance our existing solutions and services, enhance our operating infrastructure and potentially acquire complementary businesses and technologies. For the three months ended April 30, 2026, our net cash provided by operating activities was $23.9 million. As of April 30, 2026, we had $76.4 million of cash and cash equivalents, which are held for working capital purposes. As of April 30, 2026, we had $84.2 million of outstanding borrowings under the Capital One Credit Facility, with the ability to borrow an additional $190.8 million.

Current wording

Our operations have consumed substantial amounts of cash since inception and we intend to continue to make significant investments to support our business growth, respond to business challenges or opportunities, develop new applications and services, enhance our existing solutions and services, enhance our operating infrastructure and potentially acquire complementary businesses and technologies. For the three and six months ended July 31, 2026, our net cash provided by operating activities was $18.3 million and $42.3 million, respectively. As of July 31, 2026, we had $72.9 million of cash and cash equivalents, which are held for working capital purposes. As of July 31, 2026, we had $60.7 million of outstanding borrowings under the Capital One Credit Facility, with the ability to borrow an additional $214.3 million.

Previous wording

Accordingly, we may need to engage in equity or debt financings or collaborative arrangements to secure additional funds. Additional financing may not be available on terms favorable to us, or at all. If we raise additional funds through further issuances of equity or convertible debt securities, our existing stockholders could suffer significant dilution, and any new equity securities we issue could have rights, preferences and privileges superior to those of holders of our common stock. Any debt financing secured by us in the future could involve additional restrictive covenants relating to our capital-raising activities and other financial and operational matters, which may make it more difficult for us to obtain additional capital and to pursue business opportunities, including potential acquisitions. In addition, during times of economic instability, it has been difficult for many companies to obtain financing in the public markets or to obtain debt financing, and we may not be able to obtain additional financing on commercially reasonable terms, if at all. If we are unable to obtain adequate financing or financing on terms satisfactory to us, it could have a material adverse effect on our business, financial condition and results of operations.

Current wording

Accordingly, we may need to engage in equity or debt financings or collaborative arrangements to secure additional funds. Additional financing may not be available on terms favorable to us, or at all. If we raise additional funds through further issuances of equity or convertible debt securities, our existing stockholders could suffer significant dilution, and any new equity securities we issue could have rights, preferences and privileges superior to those of holders of our common stock. Any debt financing secured by us in the future could involve additional restrictive covenants relating to our capital-raising activities and other financial and operational matters, which may make it more difficult for us to obtain additional capital and to pursue business opportunities, including potential acquisitions.

Previous wording

The New Capital One Credit Agreement contains various restrictive covenants that limit our ability to take certain actions, including, but not limited to, our ability to grant or incur liens, dispose of assets, incur additional indebtedness, make certain investments, restricted payments (including dividends) and restricted debt payments, enter into certain mergers and acquisitions. In addition, the New Capital One Credit Facility contains financial covenants applicable from time to time, which include Total Net Leverage Ratio and Fixed Charge Coverage Ratio and Minimum Liquidity, as such terms are defined in the New Capital One Credit Agreement. Additionally, the Receivables Purchase Agreement contains various affirmative and negative covenants, reserve requirements, and termination events.

Current wording

The New Capital One Credit Agreement contains various restrictive covenants that limit our ability to take certain actions, including, but not limited to, our ability to grant or incur liens, dispose of assets, incur additional indebtedness, make certain investments, restricted payments (including dividends) and restricted debt payments, enter into certain mergers and acquisitions. In addition, the New Capital One Credit Facility contains financial covenants applicable from time to time, which include Total Net Leverage Ratio and Fixed Charge Coverage Ratio and Minimum Liquidity, as such terms are defined in the New Capital One Credit Agreement. Additionally, the Receivables Purchase Agreement contains various affirmative and negative covenants, reserve requirements, and termination events. The Receivables Purchase Agreement contains financial covenants that, among other things, require us to maintain minimum liquidity of $50.0 million (consisting of unrestricted cash and cash equivalents of Phreesia plus availability under securitization agreements).

Previous wording

In addition, because we are incorporated in Delaware, we are governed by the provisions of Section 203 of the Delaware General Corporate Law ("DGCL"), which may prohibit certain business combinations with stockholders owning 15% or more of our outstanding voting stock. These anti-takeover provisions and other provisions in our certificate of incorporation and our bylaws could make it more difficult for stockholders or potential acquirers to obtain control of our board of directors or initiate actions that are opposed by the then-current board of directors and could also delay or impede a merger, tender offer or proxy contest involving our company. These provisions could also discourage proxy contests and make it more difficult for stockholders to elect directors or cause us to take other corporate actions. Any delay or prevention of a change of control transaction or changes in our board of directors could cause the market price of our common stock to decline.

Current wording

In addition, because we are incorporated in Delaware, we are governed by the provisions of Section 203 of the Delaware General Corporation Law ("DGCL"), which may prohibit certain business combinations with stockholders owning 15% or more of our outstanding voting stock. These anti-takeover provisions and other provisions in our certificate of incorporation and our bylaws could make it more difficult for stockholders or potential acquirers to obtain control of our board of directors or initiate actions that are opposed by the then-current board of directors and could also delay or impede a merger, tender offer or proxy contest involving our company. These provisions could also discourage proxy contests and make it more difficult for stockholders to elect directors or cause us to take other corporate actions. Any delay or prevention of a change of control transaction or changes in our board of directors could cause the market price of our common stock to decline.