PHR US Equity☆

phr-20240131

Table of Contents

UNITED STATES

SECURITIES AND EXCHANGE COMMISSION

Washington, DC 20549

(Mark One)

For the fiscal year ended January 31, 2024

OR

For the transition period from _ to _

Commission File Number: 001-38977

PHREESIA, INC.

(Exact Name of Registrant as Specified in Its Charter)

(Address of Principal Executive Offices) (Zip Code)

(888) 654-7473

(Registrant’s Telephone Number, Including Area Code)

Securities registered pursuant to Section 12(b) of the Act:

Title of each class Trading Symbol Name of each exchange on which registered

Common stock, $0.01 par value per share PHR The New York Stock Exchange

Securities registered pursuant to Section 12(g) of the Act:

None

Indicate by check mark if the registrant is a well-known seasoned issuer, as defined in Rule 405 of the Securities Act. Yes☒ No ☐

Indicate by check mark if the registrant is not required to file reports pursuant to Section 13 or Section 15(d) of the Act. Yes ☐No☒

Indicate by check mark whether the registrant (1) has filed all reports required to be filed by Section 13 or 15(d) of the Securities Exchange Act of 1934 during the preceding 12 months (or for such shorter period that the registrant was required to file such reports), and (2) has been subject to such filing requirements for the past 90 days. Yes☒ No ☐

Indicate by check mark whether the registrant has submitted electronically every Interactive Data File required to be submitted pursuant to Rule 405 of Regulation S-T (§ 232.405 of this chapter) during the preceding 12 months (or for such shorter period that the registrant was required to submit such files). Yes☒ No ☐

Indicate by check mark whether the registrant is a large accelerated filer, an accelerated filer, a non-accelerated filer, a smaller reporting company, or an emerging growth company. See the definitions of “large accelerated filer”, “accelerated filer”, “smaller reporting company”, and “emerging growth company” in Rule 12b-2 of the Exchange Act.

Emerging growth company ☐

If an emerging growth company, indicate by check mark if the registrant has elected not to use the extended transition period for complying with any new or revised financial accounting standards provided pursuant to Section 13(a) of the Exchange Act. ☐

Indicate by check mark whether the Registrant has filed a report on and attestation to its management’s assessment of the effectiveness of its internal controls over financial reporting under Section 404(b) of the Sarbanes-Oxley Act (15 U.S.C. 7262(b)) by the registered public accounting firm that prepared or issued its audit report.Yes☒ No☐

If securities are registered pursuant to Section 12(b) of the Act, indicate by check mark whether the financial statements of the registrant included in the filing reflect the correction of an error to previously issued financial statements.☐

Indicate by check mark whether any of those error corrections are restatements that required a recovery analysis of incentive-based compensation received by any of the registrant’s executive officers during the relevant recovery period pursuant to §240.10D-1(b). ☐

Indicate by check mark whether the registrant is a shell company (as defined in Rule 12b-2 of the Act). Yes ☐ No ☒

The aggregate market value of the common stock held by non-affiliates of the registrant, based on the closing price of a share of common stock on July 31, 2023, the last business day of the registrant’s most recently completed second fiscal quarter, as reported by the New York Stock Exchange on such date was approximately $1,617,063,047. This calculation does not reflect a determination that certain persons are affiliates of the registrant for any other purpose.

As of March 6, 2024, there were 56,387,472 shares of the registrant’s common stock, par value $0.01 per share, outstanding.

1 Phreesia, Inc. is a fully remote company and no longer maintains its principal executive office. The address listed here is the mailing address that we maintain. For purposes of compliance with applicable requirements of the Securities Act of 1933, as amended, and

Securities Exchange Act of 1934, as amended, stockholder communications required to be sent to our principal executive offices should

be directed to the email address set forth in our proxy materials and/or identified on our investor relations website.

DOCUMENTS INCORPORATED BY REFERENCE

Portions of the registrant’s Definitive Proxy Statement relating to its 2024 Annual Meeting of Stockholders to be filed hereafter are incorporated by reference into Part III of this Annual Report on Form 10-K where indicated.

1

Table of Contents

Table of Contents

PART I.

Item 1. Business 6

Item 1A. Risk Factors 19

Item 1B. Unresolved Staff Comments 50

Item 1C. Cybersecurity 50

Item 2. Properties 52

Item 3. Legal Proceedings 52

Item 4. Mine Safety Disclosures 52

PART II.

Item 6. Reserved 54

Item 7A. Quantitative and Qualitative Disclosures about Market Risk 71

Item 8. Financial Statements and Supplementary Data 72

Item 9A. Controls and Procedures 112

Item 9B. Other Information 113

Item 9C. Disclosure Regarding Foreign Jurisdictions that Prevent Inspections 114

PART III.

Item 10. Directors, Executive Officers and Corporate Governance 115

Item 11. Executive Compensation 115

Item 14. Principal Accountant Fees and Services 115

PART IV.

Item 15. Exhibits, Financial Statement Schedules 116

2

Table of Contents

Summary of Material Risks Associated with our Business

Our business is subject to numerous risks and uncertainties that you should be aware of in evaluating our business. These risks and uncertainties include, but are not limited to, the following:

•We have grown rapidly in recent periods, and as a result, our expenses have continued to increase. If we fail to manage our growth effectively, our revenue may not increase and we may be unable to implement our business strategy.

•We operate in a highly competitive industry, and if we are not able to compete effectively, including with the electronic health records ("EHR") and practice management ("PM") systems with which we integrate, our business and results of operations will be harmed.

•We have experienced net losses in the past and we may not achieve profitability in the future.

•Privacy concerns or security breaches or incidents relating to our SaaS-based solutions could result in economic loss, damage to our reputation, deterring users from using our products, and our exposure to legal penalties and liability.

•Business or economic disruptions or global health concerns have harmed and may continue to harm our business and increase our costs and expenses.

•We typically incur significant upfront costs in our client relationships, and if we are unable to develop or grow these relationships over time, we are unlikely to recover these costs and our operating results may suffer.

•As a result of our variable sales and implementation cycles, we may be unable to recognize revenue to offset expenditures, which could result in fluctuations in our quarterly results of operations or otherwise harm our future operating results.

•We depend on our senior management team and certain key employees, and the loss of one or more of our executive officers or key employees or an inability to attract and retain highly skilled employees could adversely affect our business.

•We have made, and in the future, may make acquisitions and investments which may be difficult to integrate, divert management resources, result in unanticipated costs or dilute our stockholders.

•We are subject to health care laws and data privacy and security laws and regulations governing our collection, use, disclosure, or storage of personally identifiable information, including protected health information and payment card data, which may impose restrictions on us and our operations, require us to change our business practices and put in place additional compliance mechanisms, and subject us to fines, penalties, lawsuits, adverse publicity, reputational harm, loss of customer trust or government enforcement actions if we are unable to fully comply with such laws.

•We rely on our third-party contractors, vendors and partners, including some outside of the United States, to execute our business strategy. Replacing them could be difficult and disruptive to our business. If we are unsuccessful in forming or maintaining such relationships on terms favorable to us, our business may not succeed.

The summary risk factors described above should be read together with the text of the full risk factors below in the section titled "Risk Factors" and in the other information set forth in this Annual Report on Form 10-K, including our consolidated financial statements and the related notes, as well as in other documents that we file with the U.S. Securities and Exchange Commission (the "SEC"). If any such risks and uncertainties actually occur, our business, prospects, financial condition and results of operations could be materially and adversely affected. The risks summarized above or described in full below are not the only risks that we face. Additional risks and uncertainties not currently known to us, or that we currently deem to be immaterial, may also materially adversely affect our business, prospects, financial condition and results of operations.

3

Table of Contents

SPECIAL NOTE REGARDING FORWARD-LOOKING STATEMENTS

This Annual Report on Form 10-K, including the sections entitled “Business,” “Risk Factors,” and “Management’s Discussion and Analysis of Financial Condition and Results of Operations,” contains express or implied statements that are not historical facts and are considered forward-looking statements within the meaning of Section 27A of the Securities Act of 1933, as amended, and Section 21E of the Securities Exchange Act of 1934, as amended. Forward-looking statements involve substantial risks and uncertainties. Forward-looking statements generally relate to future events or our future financial or operating performance and may contain projections of our future results of operations or of our financial information or state other forward-looking information. In some cases, you can identify forward-looking statements by the following words: “may,” “will,” “could,” “would,” “should,” “expect,” “intend,” “plan,” “anticipate,” “believe,” “estimate,” “predict,” “project,” “potential,” “continue,” “ongoing,” or the negative of these terms or other comparable terminology, although not all forward-looking statements contain these words.

Although we believe that the expectations reflected in these forward-looking statements are reasonable, these statements relate to future events or our future operational or financial performance, and involve known and unknown risks, uncertainties, and other factors that may cause our actual results, performance, or achievements to be materially different from any future results, performance, or achievements expressed or implied by these forward-looking statements. Forward-looking statements contained in this Annual Report on Form 10-K include, but are not limited to, statements about:

•our future financial performance, including our revenue, cash flows, costs of revenue and operating expenses;

•the rapidly evolving industry and the market for technology-enabled services in healthcare in the United States being relatively immature and unproven;

•our reliance on a limited number of clients for a substantial portion of our revenue;

•our anticipated growth and growth strategies and our ability to effectively manage that growth;

•our ability to achieve and grow profitability;

•the sufficiency of our cash, cash equivalents and investments to meet our liquidity needs;

•our potential competition with our customers or partners;

•our existing clients not renewing their existing contracts with us, renewing at lower fee levels or declining to purchase additional applications from us;

•our failure to adequately maintain our direct sales force, impeding our growth;

•our ability to recover the significant upfront costs in our customer relationships;

•liability arising from our collection, use, disclosure, or storage of sensitive data collected from or about patients;

•our reliance on third-party vendors, manufacturers and partners to execute our business strategy;

•consolidation in the healthcare industry resulting in loss of clients;

•the uncertainty and ongoing flux of the regulatory and political framework;

•our ability to determine the size of our target market;

•the impact of pandemics or epidemics, market volatility, including the recent high inflationary and high interest rate environment, bank failures and measures taken in response thereto, economic slowdowns and recessions, and other global financial, economic and political events on our business and our ability to attract, retain and cross-sell to healthcare services clients;

•our ability to obtain, maintain and enforce intellectual property for our technology and products;

•our inability to implement our solutions for clients resulting in loss of clients and reputation;

•our dependency on our key personnel, and our ability to attract, hire, integrate, and retain key personnel, including as a result of being a fully remote company;

•the possibility that we may become subject to future litigation;

•our future indebtedness and contractual obligations;

4

Table of Contents

•our expectations regarding trends in our key metrics and revenue from subscription fees from our healthcare services clients, payment processing fees and fees charged to our life sciences and payer clients for delivering direct communications to help activate, engage and educate patients about topics critical to their health;

•the intended benefits of our acquisitions, including that of Comsort, Inc., d/b/a MediFind ("MediFind") on June 30, 2023, Access eForms, LLC ("Access") on August 11, 2023 and ConnectOnCall.com, LLC ("ConnectOnCall") on October 3, 2023;

•our plans and expectations regarding operations in India; and

•other risks and uncertainties, including those listed under the section titled “Risk Factors”.

We caution you that the foregoing list may not contain all of the forward-looking statements made in this Annual Report on Form 10-K. You should not rely upon forward-looking statements as predictions of future events. We have based our forward-looking statements primarily on our current expectations and projections about future events and trends that we believe may affect our business, financial condition, results of operations and prospects. The outcome of the events described in these forward-looking statements is subject to risks, uncertainties and other factors, including, without limitation, those described in the section titled “Risk Factors” in this Annual Report on Form 10-K.

Moreover, we operate in a very competitive and rapidly changing environment. New risks and uncertainties emerge from time to time and it is not possible for us to predict all risks and uncertainties that could have an impact on the forward-looking statements contained in this Annual Report on Form 10-K. We cannot assure you that the results, events and circumstances reflected in these forward-looking statements will be achieved or occur, and actual results, events or circumstances could differ materially from those described in the forward-looking statements.

The forward-looking statements contained in this Annual Report on Form 10-K speak only as of the date on which the statements are made. We undertake no obligation to update, and expressly disclaim the obligation to update, any forward-looking statements made in this Annual Report on Form 10-K to reflect events or circumstances after the date of this Annual Report on Form 10-K or to reflect new information or the occurrence of unanticipated events, except as required by law. We may not actually achieve the plans, intentions or expectations disclosed in our forward-looking statements and you should not place undue reliance on our forward-looking statements.

This Annual Report on Form 10-K includes statistical and other industry and market data that we obtained from industry publications and research, surveys and studies conducted by third parties. Industry publications and third-party research, surveys and studies generally indicate that their information has been obtained from sources believed to be reliable, although they do not guarantee the accuracy or completeness of such information. We have not independently verified the information contained in such sources.

NOTE REGARDING COMPANY REFERENCES

Unless the context otherwise requires, the terms “Phreesia,” “the Company,” “we,” “us,” and “our” in this Annual Report on Form 10-K refer to Phreesia, Inc.

5

Table of Contents

PART I

Item 1. Business

Overview

We are a leading provider of comprehensive software solutions that improve the operational and financial performance of healthcare organizations and improve health outcomes by helping patients take a more active role in their care. Our solutions include SaaS-based integrated tools that manage patient access, registration and payments. We have tools to communicate with patients about their health and have demonstrated increased rates of preventive care and vaccinations.Additionally, our solutions include clinical assessments to screen patients for a variety of physical, behavioral and mental health conditions, helping providers to better understand their patients and connect them to needed services, resulting in improved health outcomes. We also provide life sciences companies, health plans and other payer organizations (payers), patient advocacy, public interest and other not-for-profit organizations with a channel for direct communication with patients. Our solutions also include additional products and services such as the MediFind provider directory, which helps patients find care based on providers' specific clinical expertise. In fiscal 2024, we facilitated patient visits in over 3,900 healthcare services clients across all 50 states. We define a patient visit as an individual, in-person or telehealth visit to a healthcare services provider, which may include multiple encounters by the same patient.

Patient intake is a complex and time-consuming process involving numerous tasks, including registration, insurance verification, patient questionnaires, patient-reported outcomes ("PROs"), payments and scheduling. Inefficiencies during the intake process often result in lower satisfaction for patients and healthcare services organizations, wasted time, missed revenue opportunities and diminished health outcomes. Phreesia’s mission is to make care easier every day. We have created an integrated and streamlined system that automates data capture and activates patients before, during and after their interaction with their healthcare services provider.

Our comprehensive range of technology solutions and services include initial patient contact, registration, appointment scheduling, payments, automated answering services, and post-appointment patient surveys. We securely collect and analyze each patient’s information and provide engagement tools to efficiently guide each patient through their healthcare journey. We deploy our solutions across a range of modalities, including through patients’ mobile devices (Phreesia Mobile), through a web-based dashboard for healthcare services clients (Phreesia Dashboard), and through our self-service intake tablets (PhreesiaPads) and on-site kiosks (Arrivals Kiosks), all of which provide an individualized experience for each patient based on age, gender, appointment type and other clinical and demographic factors. Our solutions are highly customizable and scalable to any size healthcare service organization and can seamlessly integrate within a client’s workflows and leading Practice Management, or PM, and Electronic Health Record, or EHR, systems. Our solutions additionally allow for secure time-of-service and post-explanation of benefits integrated payments.

We serve an array of healthcare services clients of all sizes across over 25 specialties, ranging from single-specialty practices, including internal and family medicine, urology, dermatology, and orthopedics, to large, multi-specialty groups, and health systems as well as regional and national payers and other organizations that provide other types of healthcare-related services. Our Network solutions revenue (as described below) is generated from clients in the pharmaceutical, biotechnology and medical device industries, as well as payers, patient advocacy, public interest and other not-for-profit organizations seeking to activate, engage and educate patients about topics critical to their health.

Our solutions

We offer our clients a comprehensive range of technology applications and modules that address the growing needs of the healthcare market by helping patients take a more active role in their care.

•Our access to care solutions provide a comprehensive appointment scheduling system to provide clients with applications for online appointments, reminders and referral tracking and management, in addition to managing inbound patient calls during and after business hours. Through our MediFind.com provider directory, we enable healthcare services clients to manage their MediFind provider profiles, helping patients to find the best doctors, latest medical advances and active clinical trials, and helping patients to book appointments.

•Our registration solutions automate patient self-registration before or at the time of the patient’s visit— via Phreesia Mobile or through the use of a purpose-built PhreesiaPad or Arrivals Kiosk for on-site check-in. Our

6

Table of Contents

Phreesia Dashboard is used by healthcare services organization staff to monitor and manage the intake process. We also collect clinical intake and PRO data for more than 25 specialties, enabling our clients to ask the right clinical questions of the appropriate patients at the right time and gather key data that aligns with their quality-reporting goals.

•Our revenue cycle solutions provide insurance-verification processes, point-of-sale payments applications, post-visit payment collection and flexible payment options, which help healthcare services clients maximize the timely collection of patient payments.

•Our network solutions provide a channel to our life sciences and payer clients that leverages our large and growing network of over 3,900 healthcare services clients. On behalf of our life sciences and payer clients, we deliver clinically relevant content to patients and health plan members who voluntarily opt in to receive this type of engagement. Additionally, our DoctorFinder product allows Life Sciences companies to embed a doctor directory in their own websites, thereby helping patients find appropriate care for their unique needs.

Our market opportunity

We serve a range of healthcare services clients, including single-specialty practices, large multi-specialty groups and health systems. We provide services to large and small pharmaceutical, medical device and biotechnology companies as well as payer organizations. We believe our current addressable market is approximately $10.0 billion and is derived from: (1) the potential $6.3 billion of subscription and related services revenue generated from the approximately 1.4 million U.S.-based healthcare services organizations who take medical appointments in ambulatory care settings and healthcare service providers who work in hospital settings, (2) the estimated potential $2.3 billion of consumer-related transaction and payment processing fees, which are based on a percentage of payments that we process through our platform and address approximately $95.0 billion of annual out of pocket patient spend in ambulatory healthcare related professional services, (3) an estimated potential $1.9 billion in Network solutions revenue, based on projections of direct-to-consumer point-of-care marketing spend and other digital, direct-to-consumer life sciences marketing spend. We estimate that our target client universe in the ambulatory and hospital markets is approximately 50,000 unique healthcare services clients. As we develop new products and services, we expect our total addressable market to grow.

Our value proposition

We are focused on providing healthcare services organizations, life sciences companies and payer organizations the tools to help patients take a more active role in their care. We believe our solutions provide a unique value proposition that is differentiated from what is offered by the traditional healthcare system.

Value proposition for patients

•Improved patient experience. Our solutions streamline the patient intake process and provides consumer-centric options for check-in. We pre-populate information from prior visits, minimizing the frustration of repetitive questions during the intake process and streamlining the information for review by a clinician by the time the patient reaches the exam room. We also offer patients a convenient, flexible, secure intake experience that saves time and provides clarity regarding the amount of payment due. The MediFind provider directory helps patients find the right care for their unique needs. Patients are also able to save time by making their appointments using our technology. Additionally, our smart answering and after hours care solution improves the patient experience by routing incoming patient calls to the appropriate healthcare resources.

•Flexible payment options. We provide patients with flexibility and choice in how they pay for healthcare services. Patients are able to pay upfront or set up an automated payment plan that adheres to our healthcare services clients' financial policies. Patients can also choose to pay online on their healthcare services organization’s website or place a card on file, removing the need for difficult payment-related conversations with staff.

•Activation in care. By leveraging the power of self-service and providing individualized and flexible software solutions, we activate patients early in their healthcare journey and provide them with relevant information to further educate them so they can take an active role in their healthcare decisions.

Value proposition for healthcare services clients

•Simplify operations and enhance staff efficiency. We enable healthcare services clients to streamline operations through automated patient intake, automated answering services and payments that are integrated into existing

7

Table of Contents

workflows and PM and EHR systems. By automating the numerous tasks and forms associated with the intake process, our healthcare services clients have been able to save time on patient check-ins and inbound calls.

•Improve cash flow and profitability and gain new business. We enable our healthcare services clients to increase collections and reduce costs. Based on client feedback received and our internal analysis, we believe that our flexible patient payment options, including card on file, have led to an increase in time-of-service collections for the majority of our healthcare services clients. Our automated eligibility and benefits verification solution also reduces the number of denied claims. Additionally, the MediFind provider directory enables providers to enhance their visibility to prospective new patients by including their profiles in the provider directory.

•Enhance clinical and cost outcomes. We enable our healthcare services clients to more efficiently and effectively capture the right clinical information to meet their clinical goals and align with quality reporting initiatives. Our logic-driven delivery of PROs and other questionnaires help healthcare services clients identify at-risk patients in need of specific care and reduce errors by avoiding the need to manually gather the information. These PROs enable our healthcare services clients to close gaps in care, identify successful treatments and engage patients in their care. Through our subsidiary, Insignia Health, LLC ("Insignia"), we license the exclusive worldwide rights to the Patient Activation Measure ("PAM"®), which we believe is widely viewed as the gold standard of patient activation measures. Extensive research over the past decade suggests that the PAM could be a critical pathway in helping healthcare services clients achieve the goals of reducing costs and improving the health of their patients. Beginning in 2024, the Centers for Medicare and Medicaid Services ("CMS") includes the PAM Performance Measure ("PAM-PM") in its Merit-based Incentive Payments System ("MIPS").

•Improve patient experience. We activate patients through their journey from access to registration to drive higher patient satisfaction, retention and safety. Our streamlined intake and payments offering provides a consumer-friendly experience and activates patients to take control of their care. Additionally, after obtaining patient consent, we enable healthcare services clients to conduct outreach within 24 hours of visit and generate real-time feedback that informs and drives efforts to improve patient experience. Providers benefit from the increased volumes of patients able to find them through the MediFind provider directory. We also provide an automated answering service that routes and triages incoming patient calls to connect patients with the appropriate care during a practice's normal business hours, as well as a service that connects patients with the appropriate care after hours.

Value proposition for life sciences and payer organizations

•Direct communications. We provide life sciences and payer organizations with a channel to engage healthcare consumers who have voluntarily opted in for such communications, when they are most receptive and actively seeking care. Our data-driven solutions provide life sciences and payer organizations the ability to reach specific populations based on various demographic, clinical, environmental and social data, allowing our clients to activate patients and members with clinically or demographically relevant health content to help facilitate conversations with their providers about treatment and prevention options.

•Speed diagnosis and increase uptake of preventive health services. Our data and analytics capabilities identify patient populations that align with our life sciences clients’ audiences. Based on our ongoing analyses of client marketing and education campaigns conducted by data analytics companies, we believe patients exposed to our campaigns are more likely, on average, to receive a relevant diagnosis, undergo a preventive health screening, or receive a relevant treatment, than control patients.

•Improve brand conversion, treatment, and adherence. Our data and analytics capabilities identify patient populations that align with our life sciences clients’ audiences. Based on our ongoing analyses of client marketing campaigns conducted by data analytics companies, we believe patients exposed to a brand campaign using our solutions are more likely, on average, to take an action, such as initiating treatment, continuing treatment, or having a prescription filled for that product, than control patients.

•Learn about patient cohorts. Our Patient Insights solutions provide a channel for our life sciences clients to deliver surveys to patients and capture direct feedback and access relevant population insights.

Our competitive landscape

We compete in a dynamic patient intake market with direct and indirect competitors that maintain varying degrees of resources and capabilities. We believe many direct competitors are focused on the basic aspects of electronic patient intake and are only starting to expand into the multiple adjacencies beyond patient registration such as access and clinical support. Some of our existing and potential service providers, particularly EHR providers, have

8

Table of Contents

developed their own patient intake solutions and have become direct competitors. Our solutions integrate with a majority of the leading EHR systems.

We believe companies in the market for comprehensive software solutions, including patient intake, compete on the basis of several factors, including:

•price;

•breadth, depth, quality and reliability of product and service offerings;

•ease of use;

•ability to drive tangible return on investment;

•client-focused implementation services and training programs;

•healthcare domain expertise;

•patient clinical content offerings;

•client support and client services; and

•ability to integrate with all of a client’s existing systems, including EHR and/or PM systems.

Life sciences marketing is highly competitive and rapidly evolving and consists of both traditional media platforms (e.g. television and print media) as well as more modern web-based and application-based platforms that provide direct-to-consumer marketing for the life sciences industries. Our direct marketing solutions are unique and compete at the point of care as well as pre- and post-visit across an array of digital devices backed by our commitment to transparency and third-party auditing. We compete on the basis of several factors, including price, quality, transparency and the ability to demonstrate meaningful return on investment.

Our growth strategies

The success of our business depends on acquiring new clients and increasing utilization among our existing clients, which in turn drives growth across our solutions. We believe we are well-positioned to benefit from a number of prevailing industry tailwinds across our patient access, registration, revenue cycle and Network solution areas. We intend to continue to proactively grow the business through the following strategies:

Expanding our solutions to new healthcare services organizations

The market for a technology-powered intake and payment solution in the U.S. healthcare industry is large and underserved, and we believe we have a substantial opportunity to grow our client base and market share. With the ability to support over 25 different medical specialties and existing agreements with leading PM and EHR providers, we are able to serve a large portion of the U.S. ambulatory and acute care market. We currently serve a small percentage of ambulatory and acute care organizations, and we plan to continue to utilize our direct sales force to win new clients.

Deepening our relationship with existing healthcare services clients

We generate recurring fees from our healthcare services clients based on the number of subscriptions to our solutions and add-on applications. As our healthcare services clients realize the value our solutions offer, they typically purchase additional subscriptions for their organizations. Our sales strategy is focused on expanding our revenue per average healthcare services client ("AHSC") and we believe there is a significant opportunity to sell new applications.

Continuing to innovate and leverage our solutions

We believe our depth, scalability and robust capabilities allow us to address key challenges facing providers, payers and life sciences organizations. As an innovative leader across these segments of healthcare, we intend to continue to invest in new value-added offerings for our clients. We have a well-defined technology roadmap to introduce new features and functionality to our products. We intend to leverage our network and patient activation capabilities to eliminate gaps in care and increase care coordination among all key healthcare constituents. By expanding and continuously enhancing our solutions, we believe we can drive incremental revenue from existing clients as well as broaden our appeal to potential new clients.

Pursuing opportunistic strategic investments, partnerships and acquisitions

Our strong growth has included significant organic growth as we have added healthcare services and life sciences clients, while also expanding the solutions we offer those clients. Throughout our history, we have effectively contracted with leading PM and EHR solution providers and will continue to evaluate strategic and innovative investments and partnerships to accelerate growth. Phreesia has also acquired products and functionalities that

9

Table of Contents

expand our suite of solutions. We evaluate many investment, partnership and acquisition opportunities on an ongoing basis. We target opportunities that enhance the breadth or depth of our ability to activate patients in their care. Our acquisitions to date have all been consistent with this philosophy, and we will continue to evaluate growth opportunities that complement our internal initiatives.

Enhancing our margins through continued strategic growth

Our business model is based on developing and deploying new, value-added applications for our clients that increase revenue and enhance our attractive client unit economics. We have invested significantly and expect to continue investing significantly to create a comprehensive, scalable suite of solutions that allow us to gain operating leverage and enhance margins. Over time, we expect to increase profitability and margins by adding new clients and by expanding our existing clients with minimal incremental investment. Moreover, we continually aim to improve effectiveness and efficiency.

Our products and services

Our solutions are specifically designed to cater to the needs of patients, healthcare services clients and life sciences and payer companies while improving healthcare engagement.

Access to Care

Weoffer healthcare services clients convenient online appointment requests for patients, appointment tracking and appointment management in one place, and provide insight into past and upcoming appointments. Our Access to Care solutions include:

•Provider directory for patients seeking care. On MediFind.com, healthcare services clients in our network can manage and update their profiles, to help new patients discover their services and book appointments.

•Integrated patient scheduling.We give patients 24/7 access to request or schedule their own in-person or virtual appointments online, either through a link or by responding to patient-outreach by their provider. Once patients self-schedule or send an appointment request, their information automatically populates into the Phreesia Appointments Hub for staff to track and manage.

•Automated appointment rescheduling. Our appointment rescheduling tool is an automated, text-based solution designed to fill open slots on a healthcare services client's schedule with clinically relevant patients. The tool leverages artificial intelligence and a custom-rules engine to offer earlier appointments for eligible patients as soon as a time slot becomes available.

•Appointment reminders. With our appointment reminder solution, patients receive email, text, and voice reminders about upcoming in-person and virtual appointments, reducing no-shows for our healthcare services clients. Patient responses to confirm, cancel or reschedule appointments flow directly into the Phreesia Appointments Hub.

•Patient text messaging. We allow healthcare services clients to send and receive text messages from individual patients about their in-person or virtual visits. This capability helps to reduce face-to-face interactions, decrease phone-call volume and improve patient communication.

•After-hours care. PhreesiaOnCall helps healthcare services clients manage patients seeking care after-hours. A provider-facing app transcribes patient messages, routes to the on-call provider, and displays key information from the patient’s chart for a more productive call.

•Smart answering solution. We help healthcare services clients manage inbound patient calls digitally with the option to follow-up via text message, reducing burden on call center and front desk staff members.

Registration

Our Registration applications facilitate mobile and on-site check-in, create a more complete patient record and increase patient convenience and satisfaction. These solutions include:

•Mobile and in-office intake modalities. We allow patients to check in securely and conveniently on their computer or mobile device, either prior to their visit or when they arrive at the office. Patients can also update their clinical and demographic information, take a photo to store in their patient record, capture images of their driver’s license and insurance card, sign forms and policies and pay copays and outstanding balances—all from the privacy and ease of their own device.

10

Table of Contents

•Registration for virtual visits. We support healthcare services clients offering telehealth by allowing them to perform all the necessary intake tasks for each virtual visit, including gathering consents, at scale. Intake for telehealth also provides patients with information about how their telehealth visit will work.

•Specialty-specific workflows. Our workflows cover over 25 specialties leveraging our proprietary logic to guide patients through a tailored list of questions, allowing them to efficiently enter and verify their demographics, insurance data and clinical information.

•Consent management. We streamline the process of collecting consents by ensuring that each patient receives the right forms. These forms can be customized by appointment type and can capture electronic signatures and send required forms directly to the PM or EHR system.

•Self service patient-reported outcomes and screenings.

•We deliver clinical assessments to screen patients for common morbidities, and we own the worldwide exclusive license to the PAMTM, a measure that we believe is widely viewed as the gold standard for measuring patient activation.

•Behavioral health screenings for primary care. We identify and screens patients for common behavioral and mental health conditions, including depression, anxiety and substance abuse.

•Social determinants of health screening. We enable healthcare services clients to ask patients confidentially about their access to healthy food, safe housing and other social determinants that can have a critical impact on their health, to help healthcare services clients better understand patients and connect them to needed services.

Revenue cycle

We are able to improve key revenue cycle metrics with our payment solutions, increasing time-of-service and post-visit collections as well as improving patient convenience with online payments and card on file. Our Revenue Cycle solutions include:

•Point-of-service payments. We offer self-service payment options on Phreesia Mobile, on the PhreesiaPad or at an Arrivals Kiosk. Healthcare services client staff can also process time-of-service or post-explanation of benefits payments on the Phreesia Dashboard. We are able to replace or support a client’s existing payment processor with a fast and secure way to process transactions, as we accept all major credit cards (Visa, MasterCard, American Express and Discover), ApplePay, and other payment methods. Phreesia is a PCI DSS Level 1 Service Provider and offers PCI-compliant point-of-sale solutions that significantly reduce the client's PCI DSS reporting requirements.

•Insurance verification. Our automated eligibility and benefits application streamlines verification, reduces staff’s manual workload and alerts staff when attention is needed. We can run eligibility and benefits checks in advance, so our clients know their patients’ primary and secondary insurance before their visit.

•Payment plans. Our healthcare services clients can give patients the option to set up private, automated payment plans when they check in, or have the staff create payment plans for them on the Phreesia Dashboard. Each plan is configured according to the healthcare services client’s financial policies and managed automatically.

•Online payments. We allow practices to add a custom payment button to their website or send email reminders that direct patients to an online payment page.

•Card on file and payment assurance. Patients may sign a financial policy that gives authorization to store their payment card on our secure solution, thus automatically collecting payments once claims are adjudicated.

Network Solutions

We provide several opportunities for third parties to engage with the patients and providers who are using the tools and products we offer.

•Education and engagement before, during and after the visit. PatientConnect is our point of care offering which enables third parties to deliver personalized health content to users who opt to receive it after they have completed checking in for a doctor's appointment via Phreesia's intake software. Clients of this tool include life sciences organizations, health plans, and patient advocacy groups. Educational and promotional

11

Table of Contents

content about health is delivered to raise patient awareness and help patients start the right conversations with their providers, improving outcomes for these individuals. Educational material includes information about different therapy options to assist in advocating for their needs and preferences; disease education, which speeds up the time to diagnosis; screening tools and information to aid in early detection and disease prevention; and public service materials about vaccines, avoiding use of tobacco products, and more.

•Patient insights. Similar to delivery of educational materials, we conduct primary research among interested users after they check in for appointments via our intake software to understand sentiments and behaviors, uncover unmet needs, and learn about preferences and health beliefs. These insights aid clients in understanding their patients’ experiences and enhancing their existing products and services.

•Referral management. We offer a suite of referral management tools for healthcare services clients that enable them to track incoming referrals in a centralized list, send referrals to specialists, and check the status of each request.

Our technology

We have continued to enhance and develop our proprietary solutions with a focus on delivering reliability, performance, security and privacy. Our solutions have demonstrated scalability and robust integration within the operating infrastructure of our healthcare services clients. Our core technology capabilities include:

•Robust integration. We integrate our technology into PMs, EHRs and ambulatory and acute system workflows for over 3,900 healthcare services clients. Data captured from the patient or generated by the use of our solutions automatically integrate into the PM and EHR systems of healthcare services clients. We currently contract with leading PM and EHR providers that collectively represent the majority of the total PM and EHR market. These providers of PM and EHR solutions and our healthcare services clients can leverage our expanding APIs to embed the functionality of our solutions for their patients, while controlling the look and feel.

•Embedded payments. Our payment processing features have been designed to operate seamlessly within the workflows of our healthcare services clients, and our revenue cycle solutions can connect directly to those making payments, to multiple clearinghouses and directly with PM, EHR and other systems.

•Scalable at cost. Our robust and scalable SaaS-based solution allows us to iterate on existing technology and develop new solutions quickly and efficiently to meet the needs of our clients. Our unique architecture also allows new integrated applications to be quickly deployed to clients and allows real-time integration without expensive and difficult-to-manage VPN tunnels. This is particularly important in a regulatory environment and industry that continues to evolve.

•Consumer-oriented. Through technological innovation, we have continued to ensure our products and services evolve to meet growing and increasingly consumer-centric demands. Our technological innovations include enhancements to our user interface, which we believe has improved user experience, accessibility and satisfaction.

•Reliable. Our technology is engineered to provide strong reliability and availability. We process hundreds of thousands of transactions, including eligibility and benefits verification, payment card processing and email and text messaging, quickly and reliably at a low cost every day.

•Secure and private. We securely manage billions of data points for millions of patients using multiple devices. Maintaining the integrity of our solutions is critical to our business, our clients and the patients they treat. As our product offerings increase and become more robust, we continue to enhance and evolve our security program.

Privacy and security

Privacy and security are our top priorities. We maintain a comprehensive security program designed to safeguard the confidentiality, integrity and availability of our clients’ data. In particular, we deploy physical, administrative and technical controls to appropriately safeguard patient information.

We offer reliability, performance, security and privacy for our clients. We have infrastructure in place with three co-located data centers, and within Microsoft Azure and Amazon Web Service environments, to securely manage and maintain our clients’ information.

We use external security auditors and industry-leading vendors, such as Sikich, A-LIGN, and Bluefin to ensure we have the controls and procedures in place to protect our clients’ sensitive information. We have industry

12

Table of Contents

certifications, including HITRUST, PCI-DSS Level 1 Service Provider, Systems and Organization Controls 2 ("SOC 2") and PCI Point-to-Point Encryption. As a PCI-DSS Level 1 Service Provider, we are committed to upholding industry security standards to cardholder data.

We are committed to protecting the information and privacy of our clients and their patients. To the extent we work as a third-party for our healthcare provider partners, we are a "Business Associate" as defined under the federal Health Insurance Portability and Accountability Act of 1996, as amended by the Health Information and Technology for Economic ad Clinical Health Act ("HITECH Act") and their implementing regulations, collectively referred to as HIPAA. As a Business Associate, we sign Business Associate Agreements that govern our uses and disclosures of protected health information ("PHI") on behalf of our covered entity clients that engage us to provide our software solutions.

Refer to Item 1C. Cybersecurity in Part I of this Annual Report on Form 10-K for additional information regarding our processes to assess, identify and manage material risks from cybersecurity threats and our board’s role in overseeing risks from cybersecurity threats.

Sales and marketing

We market and sell our products and services to healthcare services prospects throughout the U.S. using a direct sales organization. Our database team is responsible for the hygiene and health of our data and is tasked with validating information by using various tools to enrich it. This data powers our sales development organization. Our marketing team identifies customer profiles, develops content and deploys one-to-many communications to soften the market. This helps prepare our sales development team to engage with new prospective customers. The sales development team creates opportunities and works with the direct sales team to qualify those opportunities. Our sales force executes on these qualified sales leads, partnering with sales enablement and client services to ensure prospects are educated on the breadth of our capabilities and demonstrable value proposition, with the goal of attracting and retaining clients and expanding their use of our solutions over time. Most of our healthcare services customer contracts are structured as annual, auto-renewing agreements. Our sales typically involve competitive processes, and sales cycles have, on average, varied in duration from three months to six months, depending on the size of the potential client. In addition, through Phreesia University (Phreesia’s in-house training program), events, client conferences and webinars, we help our healthcare services clients optimize their businesses and, as a result, support client retention.

We also sell products and services to life sciences and payer organizations, healthcare advertising agencies and advocacy groups as well as advertising agencies through our direct sales and marketing teams. Most of the life science campaigns need to be measured and resold each year. Like healthcare services, the marketing team supports net new business and client retention for life sciences by educating ideal customer profiles about the value of Phreesia and the positive impact on health outcomes Phreesia campaigns have on patients.

Subscriber services and support

Our operations and support organizations differentiate and enhance our clients’ and patients’ experience. Our teams have significant experience integrating with various EHR and PM systems, which can help take our healthcare services clients from sale to go-live much quicker than other solutions. Our client-focused operations are structured to provide a seamless process.

•Client services. Our dedicated Client Services team is responsible for pre-sales engagement, new client onboarding and implementation, existing client implementation and on-site optimization. Client Services is organized by market specialization, ensuring that our team provides deep expertise in the markets they support. In addition, our implementation teams have extensive knowledge of the PM and EHR systems that our healthcare services clients use. Through our designed implementation approach and expertise, we are able to take healthcare services clients live efficiently and quickly. Our Client Services team is also able to demonstrate early return on investment in land-and-expand deals, enabling us to roll out to additional locations.

•Client success. Our success is driven by our ability to retain and expand relationships with existing and new clients. Our dedicated Client Success team is focused on the retention of our client base, coordinating directly with Sales and Client Services to meet this objective. Furthermore, we are continuously expanding our business and enhancing our clients' experience by offering additional products to our clients and driving adoption and utilization.

•Client support. We provide technical support to our healthcare services clients through our dedicated Client Support team to directly resolve any product and/or service issues. We serve as the single starting point for

13

Table of Contents

client issues and offer a collaborative support model in contrast to tiered support models. This model has proven to help large companies continue to scale, while leveraging the benefits of smaller operations.

We are committed to providing quality services and support, with a focus on integration, implementation support and overall client satisfaction.

Regulatory Matters

Our business is subject to extensive, complex and rapidly changing federal and state laws and regulations. Various federal and state agencies have discretion to issue regulations and interpret and enforce healthcare laws. While we routinely evaluate our legal positions under applicable healthcare laws and regulations, these regulations can vary significantly from jurisdiction to jurisdiction, and interpretation and enforcement of existing laws and regulations can be uncertain or may change periodically. Moreover, in many jurisdictions in which we operate, neither our current nor our anticipated business model has been the subject of judicial or administrative interpretation. We cannot be assured that a review of our business by courts or regulatory authorities will not result in determinations that could adversely affect our operations or that the healthcare regulatory environment will not change in a way that restricts our operations. Federal and state legislatures also may enact various legislative proposals that could materially impact certain aspects of our business. In addition, our consumer transactions business is subject to certain financial services laws, regulations and rules, such as the Payment Card Industry Data Security Standards.

U.S. state and federal health information privacy and security laws

There are numerous U.S. federal and state laws and regulations related to the privacy and security of personally identifiable information, including health information. In particular, the Health Insurance Portability and Accountability Act of 1996, or HIPAA, establishes privacy and security standards that limit the use and disclosure of protected health information, referred to as PHI, and require the implementation of administrative, physical, and technical safeguards to ensure the confidentiality, integrity and availability of individually identifiable health information in electronic form. Many of our customers are regulated as covered entities under HIPAA. As a service provider who creates, receives, maintains or transmits PHI on behalf of our covered entity customers, Phreesia is a “business associate” as defined under HIPAA, and certain HIPAA requirements are directly applicable to business associates.

Violations of HIPAA may result in civil and criminal penalties and a single breach incident can result in violations of multiple standards. We must also comply with HIPAA’s breach notification rule. Under the breach notification rule, business associates must notify covered entities of a breach, and those covered entities must notify affected individuals without unreasonable delay in the case of a breach of unsecured PHI, which may compromise the privacy, security or integrity of the PHI. In addition, notification must be provided to the U.S. Department of Health and Human Services, or HHS, and the local media in cases where a breach affects more than 500 individuals. Breaches affecting fewer than 500 individuals must be reported to HHS on an annual basis. In the event of a breach, our covered entity customers may require we provide assistance in the breach notification process and may seek indemnification and other contractual remedies.

State attorneys general also have the right to prosecute HIPAA violations committed against residents of their states. While HIPAA does not create a private right of action that would allow individuals to sue in civil court for a HIPAA violation, its standards have been used as the basis for the duty of care in state civil suits, such as those for negligence or recklessness in misusing personal information. In addition, HIPAA mandates that HHS conduct periodic compliance audits of HIPAA covered entities and their business associates. It also tasks HHS with establishing a methodology whereby harmed individuals who were the victims of breaches of unsecured PHI may receive a percentage of the Civil Monetary Penalty fine paid by the violator. In light of the HIPAA Omnibus Final Rule, recent enforcement activity, and statements from HHS, we expect increased federal and state HIPAA privacy and security enforcement efforts.

There has been increasing focus on the application of HIPAA and other privacy laws to technology companies.

Other federal and state laws restrict the use and protect the privacy and security of personally identifiable information. For example, according to the Federal Trade Commission (FTC), failing to take appropriate steps to keep consumers’ personal information secure constitutes unfair acts or practices in or affecting commerce in violation of Section 5(a) of the Federal Trade Commission Act, 15 U.S.C. § 45(a). The FTC expects a company’s data security measures to be reasonable and appropriate in light of the sensitivity and volume of consumer information it holds, the size and complexity of its business and the cost of available tools to improve security and reduce vulnerabilities. Individually identifiable health information is considered sensitive data that merits stronger safeguards. In recent years, the FTC has paid increased attention to privacy and data security matters, and we expect them to continue to do so in the future.

14

Table of Contents

Many states in which we operate and in which our patients reside also have laws that protect the privacy and security of sensitive and personal information, including health information, and are, in many cases, not preempted by HIPAA and may be subject to varying interpretations by courts and government agencies. These laws may be similar to or even more protective than HIPAA and other federal privacy laws. For example, the laws of the State of California, in which we operate, are more restrictive than HIPAA. The California Consumer Privacy Act, or CCPA, as amended by the California Privacy Rights Act, or CPRA, creates individual privacy rights for California consumers (as defined in the law) and places increased privacy and security obligations on entities handling personal data of consumers or households. The CCPA requires covered companies to provide certain disclosures to consumers about its data collection, use and sharing practices, and to provide affected California residents with ways to opt-out of certain sales or transfers of personal information. Additionally, as of January 1, 2023, California has a new state agency that is vested with authority to implement and enforce the CCPA. While any information we maintain in our role as a business associate may be exempt from the CCPA, other records and information we maintain may be subject to the CCPA.

We expect that there will continue to be new proposed and amended laws, regulations and industry standards concerning privacy, data protection and information security in the U.S. Already in the U.S. we have witnessed significant developments at the state level. In addition to the CCPA, new privacy and data security laws have been enacted in numerous other states and have been proposed in even more states as well as in the U.S. Congress, reflecting a trend toward more stringent privacy legislation in the U.S., which may accelerate. If enacted, such proposed legislation, may add additional complexity, variation in requirements, restrictions and potential legal risk, require additional investment of resources in compliance programs, impact strategies and the availability of previously useful data and could result in increased compliance costs and/or changes in business practices and policies. The existence of comprehensive privacy laws in different states in the country would make our compliance obligations more complex and costly and may increase the likelihood that we may be subject to enforcement actions or otherwise incur liability for noncompliance.

Where state laws are more protective than HIPAA, we must comply with these additional state laws. In certain cases, it may be necessary to modify our planned operations and procedures to comply with these more stringent state laws. Not only may some of these state laws impose fines and penalties upon violators, but also some state laws, unlike HIPAA, may afford private rights of action to individuals who believe their personal information has been misused. In addition, state laws are changing rapidly, and there is discussion of a new federal privacy law or federal breach notification law, to which we may be subject.

In addition to HIPAA, state health information privacy and state health information privacy laws, we may be subject to other state and federal privacy laws. Such laws, for example, could include state laws that prohibit unfair privacy and security practices and deceptive statements about privacy and security and laws that place specific requirements on certain types of activities, such as data security and texting.

In recent years, there have been a number of well publicized data breaches involving the improper use and disclosure of personally identifiable information and PHI. Many states have responded to these incidents by enacting laws requiring holders of personal information to maintain safeguards and to take certain actions in response to a data breach, such as providing prompt notification of the breach to affected individuals and state officials. In addition, under HIPAA and pursuant to the related contracts with our business associates, we must report breaches of unsecured PHI to our contractual partners following discovery of the breach. Notification must also be made in certain circumstances to affected individuals, federal authorities and others.

U.S. federal and state telecommunications laws

There are number of U.S. federal and state laws and regulations that concern telephone calls, text messages and other telephonic communications to patients, potential patients, clients, and potential clients.For example, the Telephone Consumer Protection Act (“TCPA”) is a federal statute that restricts certain calls and text messages to individuals.Some states, including Florida and Oklahoma, have mini-TCPA laws that restrict certain calls and text messages to their residents and mini-TCPA laws have been proposed in other state legislatures.Our call and text communications are or may be (or may become) subject to these laws.

U.S. federal contracting laws

Our subsidiary, Insignia, as a federal government contractor, is obligated to comply with applicable laws and regulations, including provisions of the Federal Acquisition Regulation ("FAR") and Section 508 of the Rehabilitation Act of 1973 (29 U.S.C. 794d), as amended by the Workforce Investment Act of 1998 ("Section 508"), in connection

15

Table of Contents

with its performance of its government contracts. Insignia’s obligations under the FAR include, for example, calculating overhead rates in accordance with the accounting procedures and internal controls required under the FAR standards. In addition, Insignia is obligated under Section 508 to ensure its services and products comply with federal accessibility standards. Consequences for violating the FAR and other laws and regulations applicable to government contracting include termination of contracts, suspension or debarment from doing future business with the government, criminal or civil remedies under the False Claims Act (as described below), and other penalties.

U.S. federal and state fraud and abuse laws

We are subject to additional healthcare regulation and enforcement by the federal government and by authorities in the states and foreign jurisdictions in which we conduct our business that may constrain the financial arrangements and relationships through which we research, as well as sell, market and distribute any products for which we obtain marketing authorization. Such laws include, without limitation, state and federal anti-kickback, fraud and abuse, false claims, and transparency laws and regulations related to drug pricing and payments and other transfers of value made to physicians and other healthcare providers. If our operations are found to be in violation of any of such laws or any other governmental regulations that apply, we may be subject to penalties, including, without limitation, administrative, civil and criminal penalties, damages, fines, disgorgement, the curtailment or restructuring of operations, integrity oversight and reporting obligations, exclusion from participation in federal and state healthcare programs and responsible individuals may be subject to imprisonment. Such laws and regulations include:

•the federal Anti-Kickback Statute, which prohibits, among other things, persons or entities from knowingly and willfully soliciting, receiving, offering or paying any remuneration (including any kickback, bribe or rebate), directly or indirectly, overtly or covertly, in cash or in kind, to induce, or in return for, the purchase, lease, order, arrangement, or recommendation of any good, facility, item or service for which payment may be made, in whole or in part, under a federal healthcare program, such as the Medicare and Medicaid programs. A person or entity does not need to have actual knowledge of this statute or specific intent to violate it to have committed a violation. In addition to a few statutory exceptions and regulatory safe harbors, the U.S. Department of Health and Human Services Office of Inspector General, or OIG, has published safe-harbor regulations that outline categories of activities that are deemed protected from prosecution under the Anti-Kickback Statute provided all applicable criteria are met. The failure of a financial relationship to meet all of the applicable safe harbor criteria does not necessarily mean that the particular arrangement violates the Anti-Kickback Statute. Violations are subject to civil and criminal fines and penalties for each violation, plus up to three times the remuneration involved, imprisonment, and exclusion from government healthcare programs. Moreover, the government may assert that a claim including items or services resulting from a violation of the Anti-Kickback Statute constitutes a false or fraudulent claim for purposes of the False Claims Act or federal civil monetary penalty laws;

•the federal civil and criminal false claims laws and civil monetary penalty laws, such as the federal False Claims Act, which impose criminal and civil penalties and authorize civil whistleblower or qui tam actions, against individuals or entities for, among other things: knowingly presenting, or causing to be presented, to the federal government, claims for payment that are false or fraudulent; knowingly making, using or causing to be made or used, a false statement of record material to a false or fraudulent claim or obligation to pay or transmit money or property to the federal government or knowingly concealing or knowingly and improperly avoiding or decreasing an obligation to pay money to the federal government. Manufacturers can be held liable under the federal False Claims Act even when they do not submit claims directly to government payors if they are deemed to “cause” the submission of false or fraudulent claims. The federal False Claims Act also permits a private individual acting as a “whistleblower” to bring actions on behalf of the federal government alleging violations of the federal False Claims Act and to share in any monetary recovery;

•HIPAA, which created new federal criminal statutes that prohibit a person from knowingly and willfully executing, or attempting to execute, a scheme to defraud any healthcare benefit program or obtain, by means of false or fraudulent pretenses, representations or promises, any of the money or property owned by, or under the custody or control of, any healthcare benefit program, regardless of the payor (e.g., public

16

Table of Contents

or private) and knowingly and willfully falsifying, concealing or covering up by any trick or device a material fact or making any materially false, fictitious, or fraudulent statements or representations in connection with the delivery of, or payment for, healthcare benefits, items or services relating to healthcare matters; similar to the federal Anti-Kickback Statute, a person or entity does not need to have actual knowledge of the statute or specific intent to violate it in order to have committed a violation;

•HIPAA, as amended by the Health Information Technology for Economic and Clinical Health Act of 2009, or HITECH and their respective implementing regulations, including the Final Omnibus Rule published in January 2013, which impose requirements on certain covered healthcare providers, health plans, and healthcare clearinghouses as well as their respective business associates, independent contractors or agents of covered entities, that perform services for them that involve the creation, maintenance, receipt, use, or disclosure of, individually identifiable health information relating to the privacy, security and transmission of individually identifiable health information. HITECH also created new tiers of civil monetary penalties, amended HIPAA to make civil and criminal penalties directly applicable to business associates, and gave state attorneys general new authority to file civil actions for damages or injunctions in federal courts to enforce the federal HIPAA laws and seek attorneys’ fees and costs associated with pursuing federal civil actions. In addition, there may be additional federal, state and non-U.S. laws which govern the privacy and security of health and other personal information in certain circumstances, many of which differ from each other in significant ways and may not have the same effect, thus complicating compliance efforts; and

•federal consumer protection and unfair competition laws, which broadly regulate marketplace activities and activities that potentially harm consumers.

Additionally, we are subject to state and foreign equivalents of each of the healthcare laws and regulations described above, among others, some of which may be broader in scope and may apply regardless of the payor. Many U.S. states have adopted laws similar to the federal Anti-Kickback Statute and False Claims Act, and may apply to our business practices, including, but not limited to, research, distribution, sales or marketing arrangements and claims involving healthcare items or services reimbursed by non-governmental payors, including private insurers. In addition, some states have passed laws that require pharmaceutical companies to comply with the April 2003 Office of Inspector General Compliance Program Guidance for Pharmaceutical Manufacturers and/or the Pharmaceutical Research and Manufacturers of America’s Code on Interactions with Healthcare Professionals. Several states also impose other marketing restrictions or require pharmaceutical companies to make marketing or price disclosures to the state and require the registration of pharmaceutical sales representatives. State and foreign laws, including for example the European Union General Data Protection Regulation, which became effective May 2018 also govern the privacy and security of health information in some circumstances, many of which differ from each other in significant ways and often are not preempted by HIPAA, thus complicating compliance efforts. There are ambiguities as to what is required to comply with these state requirements and if we fail to comply with an applicable state law requirement we could be subject to penalties. Finally, there are state and foreign laws governing the privacy and security of health information, many of which differ from each other in significant ways and often are not preempted by HIPAA, thus complicating compliance efforts.

Intellectual property

Our continued growth and success depend, in part, on our ability to protect our intellectual property and proprietary technology. We primarily protect our intellectual property through a combination of trademarks, trade secrets and other contractual rights, including confidentiality, non-disclosure and assignment-of-invention agreements with our employees, independent contractors, consultants and companies with which we conduct business.

However, these intellectual property rights and procedures may not prevent others from creating a competitive SaaS solution or otherwise competing with us. We may be unable to obtain, maintain and enforce the intellectual property rights on which our business depends, and assertions by third parties that we violate their intellectual property rights could have a material adverse effect on our business, financial condition and results of operations.

Human Capital Resources

17

Table of Contents

As of January 31, 2024, we had 1,438 full-time employees, including 512 in sales and marketing, 473 in research and development, 294 in services and support and 159 in general and administrative. As of January 31, 2024, we had 946 full-time employees in the United States and 492 full-time employees internationally. We also supplement our workforce with contractors and consultants, including a substantial number of contractors and consultants in international locations. For example, as of January 31, 2024 we had a strategic relationship with Rayden Design Studio Private Ltd. (“Rayden”), pursuant to which approximately 1,000 Rayden India-based personnel supported our business through various functions, including, but not limited to, customer operations, research and development, product management and support, sales and marketing, and finance and accounting. None of our employees are represented by labor unions or covered by collective bargaining agreements. We consider our relationship with our employees to be good, and we have not experienced any work stoppages.

Talent and Culture: The success and continued evolution of our company has been due in large part to the talent and engagement of our entire team. Our team members are key pillars of our success and fostering and developing their talent is central to our culture. Attracting and retaining top talent is a high priority for us, and we look to hire smart, passionate, diverse and driven individuals who want to be a part of our mission. Our strong company culture and investment in long-term career growth for our people is evidenced by the long tenure of many of our team members with our organization. We believe our success is due in large part to the continued engagement of our talented and committed team. During our fiscal year ended January 31, 2024, Modern Healthcare magazine recognized Phreesia as one of the “Best Places to Work in Healthcare” for the seventh time, and Phreesia was named to the list of "The Top 100 Software Companies of 2023" by the Software Report, our second year in a row on the list. Additionally, Phreesia was named as one of 2023 Achievers 50 "Most Engaged Workplaces". Phreesia has also had representation on the Software Report's Top 50 Women Leaders in SaaS for the past six years. All of these achievements optimally position us to continue to attract top healthcare and technology talent.

Diversity and Inclusiveness: We are committed to hiring, developing and supporting a diverse and inclusive workplace. We employ strong recruiting practices that actively seek out and engage underrepresented groups. We strive to make career paths, career development opportunities and mentorships available to all employees. Additionally, we cultivate opportunities for diverse voices to be heard and supported. Our employee resource groups ("ERGs") support our commitment to promoting and maintaining an inclusive culture for all employees by bringing together individuals from a wide range of backgrounds, experiences and perspectives. These groups seek to foster a sense of shared community and empowerment for employees who share a common social identity, such as gender, race, ethnicity, disability and sexual orientation. Phreesians can voluntarily join an ERG to network, discuss and exchange ideas and enhance their professional development.

We recognize that our ability to execute on our mission of making care easier every day depends on our people. We are also committed to supporting gender equality in our organization, including through our inclusive culture, board representation, pathways to leadership for women, pay equity and strong family-leave policies.

We published our fourth Phreesia Gender Equality Report in 2023 based on the framework provided by the Bloomberg Gender Equality Index which has included Phreesia in January 2021, 2022, and 2023.

Remote Workforce: We have operated as a fully remote company since 2020, as we believe this arrangement allows us access to the best talent and creates optimal flexibility for our employees.

Corporate Information

We are a fully remote company and do not maintain principal executive offices. Our mailing address is 1521 Concord Pike, Suite 301, PMB 221, Wilmington, DE 19803, and our telephone number is (888) 654-7473. Our website address is http://www.phreesia.com. We do not incorporate the information on or accessible through our website into this report, and you should not consider any information on, or that can be accessed through, our website as part of this report.

Available Information

Our Annual Report on Form 10-K, Quarterly Reports on Form 10-Q, Current Reports on Form 8-K, and all amendments to these filings, are available free of charge from our investor relations website at https://ir.phreesia.com as soon as reasonably practicable following our filing with or furnishing to the Securities and Exchange Commission, or SEC, of any of these reports. The SEC maintains an Internet website at https://

18

Table of Contents

www.sec.gov that contains reports, proxy and information statements, and other information regarding issuers that file electronically with the SEC.

Phreesia investors and others should note that we announce material information to the public about our company, products and services and other issues through a variety of means, including our website at https://www.phreesia.com, our investor relations website at https://ir.phreesia.com, press releases, SEC filings and public conference calls, in order to achieve broad, non-exclusionary distribution of information to the public. We also use the following social media channels as a means of disclosing information about the company, our solutions, our planned financial and other announcements and attendance at upcoming investor and industry conferences, and other matters and for complying with our disclosure obligations under Regulation FD:

PHREESIA Twitter Account (https://twitter.com/phreesia)

PHREESIA Facebook Page (https://www.facebook.com/phreesia/)

PHREESIA LinkedIn Page (https://www.linkedin.com/company/phreesia)

PHREESIA Instagram Account (https://www.instagram.com/phreesia.co)

PHREESIA News Page (https://www.phreesia.com/news/)

PHREESIA Life Sciences Twitter Account (https://twitter.com/PhreesiaLifeSci)

PHREESIA Life Sciences Facebook Page (https://www.facebook.com/PhreesiaLifeSciences/)

PHREESIA Life Sciences LinkedIn Page (https://www.linkedin.com/company/phreesia-life-sciences/)

PHREESIA Life Sciences Page (https://lifesciences.phreesia.com)

INSIGNIA Health website (https://www.insigniahealth.com/)

MEDIFIND website (https://www.medifind.com/)

We encourage our investors and others to review the information we make public in these locations as such information could be deemed to be material information. Please note that this list may be updated from time to time.

The contents of any website referred to in this Annual Report on Form 10-K are not intended to be incorporated into this Annual Report on Form 10-K or in any other report or document we file with the SEC, and any references to our websites are intended to be inactive textual references only.

ITEM 1A. RISK FACTORS

Risk factors

A description of the risks and uncertainties associated with our business and industry is set forth below. You should carefully consider the risks and uncertainties described below, together with all of the other information in this Annual Report on Form 10-K, including our consolidated financial statements and notes thereto and the “Management’s discussion and analysis of financial condition and results of operations” section of Annual Report on Form 10-K, before deciding whether to purchase shares of our common stock. If any of the following risks are realized, our business, financial condition, operating results and prospects could be materially and adversely affected. In that event, the price of our common stock could decline, perhaps significantly. Additional risks and uncertainties not presently known to us or that we currently deem immaterial also may impair our business operations. Certain statements in this Annual Report on Form 10-K are forward-looking statements. See the section of this Annual Report on Form 10-K titled “Special Note Regarding Forward-Looking Statements.”

Risks relating to our business and industry

We have grown rapidly in recent periods, and as a result, our expenses have continued to increase. If we fail to manage our growth effectively, our revenue may not increase, and we may be unable to implement our business strategy.

We have experienced significant growth in recent periods, which puts strain on our business, operations and employees. We anticipate that our operations will continue to expand. As we continue to grow, both organically and through acquisitions, we must effectively integrate, develop, and manage an increasingly distributed employee base in a fully remote working environment. We may find it challenging to maintain the same level of employee productivity while executing our growth plan, fostering collaboration, and maintaining the beneficial aspects of our culture, and any such failures could negatively affect our future success, including our ability to attract and retain highly qualified employees and to achieve our business objectives.

In addition, to manage our current and anticipated future growth effectively, we must continue to maintain and enhance our IT infrastructure, financial and accounting systems and controls and continue to build our qualified work force in key areas of our company. A key element of how we manage our growth is our ability to scale our

19

capabilities and satisfactorily implement solutions for our clients’ needs. Our healthcare services clients often require specific features or functions unique to their organizational structure, which, at a time of significant growth or during periods of high demand, may strain our implementation capacity and hinder our ability to successfully implement our solutions for our clients in a timely manner. If we are unable to address the needs of our healthcare services clients or our healthcare services clients are unsatisfied with the quality of our solutions or our services due to our inability to manage our rapid growth, they may not renew their contracts, seek to cancel or terminate their relationship with us or renew on less favorable terms, any of which could adversely affect our business.

Failure to effectively manage our growth could also lead us to over-invest or under-invest in development and operations, result in weaknesses in our infrastructure, systems or controls, give rise to operational mistakes, financial losses, loss of productivity or business opportunities and result in loss of employees and reduced productivity of remaining employees. In addition, our growth has required and is expected to require significant capital expenditures and may divert financial resources from other projects such as the development of new applications and services. We may also need to make further investments in our technology and automate portions of our solutions or our services to decrease our costs. If our management is unable to effectively manage our growth, our revenue may not increase (including sufficiently to offset our expenses) or may grow more slowly than expected and we may be unable to implement our business strategy.

We operate in a highly competitive industry, and if we are not able to compete effectively, including with the EHR and PM systems with which we integrate, our business and results of operations will be harmed.

The market for our products and services is fragmented, competitive and characterized by rapidly evolving technology standards, evolving regulatory requirements, changes in client needs and the frequent introduction of new products and services. Our competitors range from smaller niche companies to large, well-financed and technologically-sophisticated entities, including the EHR and PM systems with which we integrate. As costs fall and technology improves, increased market saturation may change the competitive landscape in favor of competitors with greater scale than we currently possess.

In order to remain competitive, we are continually involved in a number of projects to compete with new market entrants by developing new services, growing our client base and penetrating new markets. These projects carry risks, such as cost overruns, delays in delivery, performance problems and lack of acceptance by our clients.

The success of our business and growth strategy depend upon our continued ability to maintain and expand a network of healthcare services clients. If we are unable to attract and retain healthcare services clients, it would have a material adverse effect on our business and ability to grow and would adversely affect our results of operations. Our success also depends on providing high-quality products and services that healthcare services clients use to improve clinical, financial and operational performance and that are used and positively received by patients. If we cannot adapt to rapidly evolving industry standards and technology and increasingly sophisticated and varied healthcare services organization and patient needs, our existing technology could become undesirable, obsolete or harm our reputation.

We believe demand for our products and services has been driven in large part by increasing patient responsibility, engagement and consumerism. Our ability to streamline the intake process and critical workflows in order to improve healthcare services organization, staff efficiency and patient engagement to allow for optimal allocation of resources will be critical to our business. Our success also depends on the ability of our solutions to increase patient engagement, and our ability to demonstrate the value of our solutions to healthcare services clients, patients and life sciences companies. If our existing clients do not recognize or acknowledge the benefits of our solutions or our solutions do not drive patient engagement, then the market for our products and services might develop more slowly than we expect, which could adversely affect our operating results.

In addition, as we and the EHR and PM solutions with which we integrate, grow and expand product offerings, the EHR and PM solutions with which we integrate could offer more competitive services. Some of these EHR and PM systems offer, or may begin to offer, services, including patient intake and engagement services, payment processing tools and direct patient communication services, in the same or similar manner as we do. Although there are many potential opportunities for, and applications of, these services, these EHR and PM systems may seek opportunities or target new clients in areas that may overlap with those that we have chosen to pursue. Such competition from these EHR and PM systems may adversely affect our business, market share and results from operations.

We compete on the basis of several factors, including breadth, depth and quality of product and service offerings, ability to deliver clinical, financial and operational performance improvement through the use of products and services, quality and reliability of services, ease of use and convenience, brand recognition, price and the ability to

20

integrate our solutions with various EHR and PM systems and other technology. Some of our competitors have greater name recognition, longer operating histories and significantly greater resources than we do. As a result, our competitors may be able to respond more quickly and effectively than we can to new or changing opportunities, technologies, standards or client requirements. In addition, current and potential competitors have established, and may in the future establish, cooperative relationships with vendors of complementary products, technologies or services to increase the availability of their products to the marketplace. Accordingly, new competitors or providers of EHR and PM solutions may emerge that have greater market share, larger client bases, more widely adopted proprietary technologies, greater marketing expertise, greater financial resources and larger sales forces than we have, which could put us at a competitive disadvantage. We also may be subject to pricing pressures as a result of, among other things, competition within the industry, consolidation of healthcare industry participants, practices of managed care organizations, government action and financial stress experienced by our clients. If our pricing experiences significant downward pressure, our business will be less profitable and our results of operations will be adversely affected. We cannot be certain that we will be able to retain our current clients or expand our client base in this competitive environment. If we do not retain current clients or expand our client base, or if we have to renegotiate existing contracts, our business, financial condition and results of operations will be harmed. Moreover, we expect that competition will continue to increase as a result of consolidation in both the healthcare information technology and healthcare industries. If one or more of our competitors or potential competitors were to merge or partner with another of our competitors, the change in the competitive landscape could also adversely affect our ability to compete effectively and could harm our business, financial condition and results of operations.

We have experienced net losses in the past and we may not achieve profitability in the future.

We have incurred significant operating losses since our inception. For the years ended January 31, 2024 and January 31, 2023, we had net losses of $136.9 million and $176.1 million, respectively, and losses from operations of $136.5 million and $176.6 million, respectively. Our operating expenses may increase in the foreseeable future as we continue to invest to grow our business and build relationships with our clients and partners, develop new solutions and operate as a public company. In addition, to the extent we are successful in increasing our client base, we could incur increased losses because significant costs associated with entering into client agreements are generally incurred up front, while revenue is generally recognized ratably over the term of the agreement. As a result, we may need to raise additional capital through equity and debt financings in order to fund our operations, which may not be available to us on favorable terms or at all. If we are unable to effectively manage these risks and difficulties as we encounter them or effectively access the capital markets, our business, financial condition and results of operations may suffer.

Our operating results have in the past and may continue to fluctuate significantly and if we fail to meet the expectations of analysts or investors, our stock price and the value of your investment could decline substantially.

Our operating results are likely to fluctuate, and if we fail to meet or exceed the expectations of securities analysts or investors, the trading price of our common stock could decline. Moreover, our stock price may be based on expectations of our future performance that may be unrealistic or that may not be met. Some of the important factors that could cause our revenues and operating results to fluctuate from quarter to quarter include:

•the extent to which our products and services achieve or maintain market acceptance;

•our ability to introduce new products and services and enhancements to our existing products and services on a timely basis;

•new competitors and the introduction of enhanced products and services from new or existing competitors;

•the length of our contracting and implementation cycles;

•the financial condition of our current and potential clients;

•our ability to integrate our solutions with the systems utilized by our healthcare services clients, including but not limited to, EHR and PM systems;

•changes in client budgets and procurement policies;

•patients' desires to receive communications from Phreesia and/or our partners, the extent to which they opt-in to such communications, and our ability to deliver a consistent volume of such communications;

•amount and timing of our investment in research and development activities and other areas of our business;

•technical difficulties or interruptions in our services;

•our ability to hire and retain qualified personnel, including the rate of expansion of our sales force;

•changes in the regulatory environment related to healthcare;

•regulatory compliance costs;

21

•the timing, size and integration success of recent and potential future acquisitions;

•unforeseen legal expenses, including litigation and settlement costs; and

•buying patterns of our clients and the related seasonality impacts on our business.

Many of these factors are not within our control, and the occurrence of one or more of them might cause our operating results to vary widely. As such, we believe that quarter-to-quarter comparisons of our revenues and operating results may not be meaningful and should not be relied upon as an indication of future performance

A significant portion of our operating expense is relatively fixed in nature, and planned expenditures are based in part on expectations regarding future revenue. Accordingly, unexpected revenue shortfalls may decrease our margins and could cause significant changes in our operating results from quarter to quarter.

Privacy concerns or security breaches or incidents relating to our SaaS-based solutions could result in economic loss, damage to our reputation, deterring users from using our products, and our exposure to legal penalties and liability.

We collect, process and store significant amounts of sensitive, confidential and proprietary information, including personally identifiable information, such as payment data and protected health information, of patients received in connection with the utilization of our solutions. Attacks on information technology systems are increasing in their frequency, levels of persistence, sophistication and intensity, they are being conducted by increasingly sophisticated and organized groups and individuals with a wide range of motives and expertise, and they may remain undetected for an extended period of time. If such an event were to occur and cause interruptions in our operations, result in the unauthorized access to, disclosure, loss, processing or other compromise of, personal information or individually identifiable health information (violating certain privacy laws such as HIPAA) or confidential information, or jeopardize the confidentiality, integrity, or availability of our solutions, it could result in a material disruption to our solutions and our business operations. In addition to extracting sensitive information, such attacks could include the deployment of harmful malware, ransomware, denial-of-service attacks, social engineering and other means to affect service reliability and threaten the confidentiality, integrity and availability of information. The prevalent use of mobile devices also increases the risk of data security incidents. While we believe we have taken reasonable steps to protect such data, techniques used to gain unauthorized access to data and systems, disable or degrade service, or sabotage systems, are constantly evolving, and we may be unable to anticipate such techniques or implement adequate preventative measures to avoid unauthorized access or other adverse impacts to such data or our systems. In addition, some of our third-party service providers and partners also collect and/or store our sensitive information and our clients' data on our behalf, and these service providers and partners are subject to similar threats of cyber-attacks and other malicious internet-based activities, which could also expose us to risk of loss, litigation, and potential liability. Even though we may have contractual protections with such vendors, contractors, or other organizations, notifications and follow-up actions related to a cybersecurity breach could impact our reputation, cause us to incur significant costs, including legal expenses, harm customer confidence, expose us to government enforcement action, hurt our expansion into new markets, cause us to incur remediation costs, or cause us to lose existing customers. The risk of state-supported and geopolitical-related cyber-attacks may increase in connection with the war in Ukraine and any related political or economic responses and counter-responses. We may not discover all such incidents or activity or be able to respond or otherwise address them promptly, in sufficient respects or at all.

We may be subject to state laws requiring notification of affected individuals and state regulators in the event of a breach of personal information, which is a broader class of information than the health information protected by HIPAA (as defined below). Furthermore, certain health privacy laws, data breach notification laws, consumer protection laws and genetic testing laws may apply directly to our business and/or those of our collaborators and may impose restrictions on our collection, use and dissemination of individuals’ health information. Patients about whom we obtain health information, as well as the healthcare services clients who share this information with us, may have statutory or contractual rights that limit our ability to use and disclose the information. We may be required to expend significant capital and other resources to ensure ongoing compliance with applicable privacy and data security laws. Claims that we have violated individuals’ privacy rights, violated applicable privacy laws and regulations or breached our contractual obligations, even if we are not found liable, could be expensive and time-consuming to defend and could result in adverse publicity that could harm our business.

Like all internet services, our service is vulnerable to software bugs, computer viruses, internet worms, break-ins, phishing attacks, attempts to overload servers with denial-of-service, or other attacks or similar disruptions from unauthorized use of our and third-party computer systems, any of which could lead to system interruptions, delays, or shutdowns, causing loss of critical data or the unauthorized access of data. Though it is difficult to determine what, if any, harm may directly result from any specific interruption or attack, any failure to maintain performance,

22

reliability, security and availability of our products, or failure to prevent software bugs, to the satisfaction of our clients or the health and safety of their patients, such events may harm our reputation and our ability to retain existing clients, and negatively affect our clients and their patients. We have in place systems and processes that are designed to protect our data, prevent data loss, disable undesirable accounts and activities on our platform and prevent or detect security breaches, however, we cannot assure you that such measures will provide absolute security.

Further, the security systems in place at our employees’ and service providers’ offices and homes may be less secure than those used in our offices, and while we have implemented technical and administrative safeguards to help protect our systems as our employees and service providers work from their offices, homes and other remote locations, we may be subject to increased cybersecurity risk, which could expose us to risks of data or financial loss, and could disrupt our business operations. There is no guarantee that the data security and privacy safeguards we have put in place will be completely effective or that we will not encounter risks associated with employees and service providers accessing company data and systems remotely. If an actual or perceived breach of security occurs to our systems or a third-party’s systems, we also could be required to expend significant resources to mitigate the breach of security, pay any applicable fines and address matters related to any such breach, including notifying users or regulators, and address reputational harm.

Business or economic disruptions or global health concerns could harm our business and increase our costs and expenses.

Broad-based business or economic disruptions or global health concerns could materially and adversely impact our business and results of operations due to, among other factors:

•a general decline in business activity;

•a potentially disproportionate impact on the healthcare services clients with whom we contract;

•disruptions to our supply chains and our third-party vendors, partners, and suppliers;

•difficulty accessing the capital and credit markets on favorable terms, or at all, and a severe disruption and instability in the global financial markets, or deteriorations in credit and financing conditions that could affect our access to capital necessary to fund business operations or address maturing liabilities on a timely basis; and

•social, economic, and labor instability in the countries in which we or the third parties with whom we engage operate.

In addition, recent macroeconomic challenges (including high levels of inflation and high interest rates) and the tight labor market continue to adversely affect workforces, organizations, governments, clients, economies, and financial markets globally and have disrupted the normal operations of many businesses, including our business, making it potentially very difficult for our clients and us to accurately forecast and plan future business activities. These factors have and could further decrease healthcare industry spending, adversely affect demand for our products and services, impair the ability of our clients to pay for the products and services they have already purchased from us, cause one or more of our clients to file for bankruptcy protection or go out of business, cause one or more of our clients to fail to renew, terminate, or renegotiate their contracts, impact expected spending from new clients, negatively impact collections of accounts receivable, and harm our business, results of operations, and financial condition.

Further, market volatility as a result of future failures of financial institutions, similar to the failures of Silicon Valley Bank and Signature Bank, could lead to market-wide liquidity shortages, impair the ability of companies to access near-term working capital needs and create additional market and economic uncertainty. During challenging economic times, our clients and patients may have difficulty gaining timely access to sufficient credit or obtaining credit on reasonable terms and may face increased costs or other negative financial impacts, each of which could impair their ability to make timely payments to us and adversely affect our revenue, which could harm our business, financial condition and results of operations.

We are a fully remote company that does not maintain a physical office presence, which subjects us to unique operational risks.

Being a fully remote company subjects us to unique operational risks. For example, technologies in our employees’ homes may not be as robust as in our offices and could cause the networks, information systems, applications, and other tools available to employees and service providers to be more limited or less reliable than in our offices. Further, the security systems in place at our employees’ homes may be less secure than those used in our offices,

23

and while we have implemented technical and administrative safeguards to help protect our systems as our employees and service providers work from home, we may be subject to increased cybersecurity risk, which could expose us to risks of data or financial loss and could disrupt our business operations. There is no guarantee that the data security and privacy safeguards we have put in place will be completely effective or that we will not encounter risks associated with employees accessing company data and systems remotely. In addition, operating remotely may negatively impact our corporate culture, including employee engagement and productivity.

If our internal controls over financial reporting or our disclosure controls and procedures are not effective, we may not be able to accurately report our financial results, prevent fraud or file our periodic reports in a timely manner, which may cause investors to lose confidence in our reported financial information and may lead to a decline in our stock price.

As a public company, we are required to maintain internal control over financial reporting and disclosure controls and procedures. Section 404 of the Sarbanes-Oxley Act of 2002 (the "Sarbanes-Oxley Act") requires that we evaluate and determine the effectiveness of our internal control over financial reporting and provide a management report on the internal control over financial reporting. Our testing, or the subsequent testing by our independent public accounting firm, may reveal deficiencies in our internal control over financial reporting that are deemed to be material weaknesses. If we are not able to comply with the requirements of Section 404 in a timely manner, or if we or our accounting firm identify deficiencies in our internal control over financial reporting that are deemed to be material weaknesses, the market price of our stock would likely decline and we could be subject to lawsuits, sanctions or investigations by regulatory authorities, including SEC enforcement actions, and we could be required to restate our financial results, any of which would require additional financial and management resources.

If material weaknesses in our internal control over financial reporting are discovered or occur in the future, our consolidated financial statements may contain material misstatements and we could be required to restate our financial results, which could materially and adversely affect our business, results of operations and financial condition, restrict our ability to access the capital markets, require us to expend significant resources to correct the material weakness, subject us to fines, penalties or judgments, harm our reputation or otherwise cause a decline in investor confidence.

We continue to invest in more robust technology and resources to manage those reporting requirements. Implementing the appropriate changes to our internal controls may distract our officers and employees, result in substantial costs and require significant time to complete. Any difficulties or delays in implementing these controls could impact our ability to timely report our financial results. For these reasons, we may encounter difficulties in the timely and accurate reporting of our financial results, which would impact our ability to provide our investors with information in a timely manner. As a result, our investors could lose confidence in our reported financial information, and our stock price could decline.

In addition, any such changes do not guarantee that we will be effective in maintaining the adequacy of our internal controls, and any failure to maintain that adequacy could prevent us from accurately reporting our financial results.

We typically incur significant upfront costs in our client relationships, and if we are unable to develop or grow these relationships over time, we are unlikely to recover these costs and our operating results may suffer.

We devote significant resources to establish relationships with new clients and deepen relationships with existing clients. Our efforts involve educating our clients and patients about the use, technical capabilities and benefits of our products and services. We do not provide access to our solutions and do not charge fees during this initial sales period. For clients that decide to enter into a contract with us, most of these contracts may provide for a preliminary trial period where a subset of healthcare services locations from the client is granted access to our solutions. Following any such trial period, we aim to increase the number of healthcare services locations within the client that utilize our solutions. Accordingly, our operating results depend in substantial part on our ability to deliver a successful client and patient experience and persuade our clients and patients to grow their relationship with us over time. As we expect to grow rapidly, our client acquisition costs could outpace revenue growth, and we may be unable to reduce our total operating costs through economies of scale such that we are unable to achieve profitability. Any increased or unexpected costs or unanticipated delays, including delays caused by factors outside of our control, could cause our operating results to suffer.

24

As a result of our variable sales and implementation cycles, we may be unable to recognize revenue to offset expenditures, which could result in fluctuations in our quarterly results of operations or otherwise harm our future operating results.

The sales cycle for our services can be variable, typically ranging from three to six months from initial contact to contract execution. During the sales cycle, we expend time and resources, and we do not recognize any revenue to offset such expenditures. Our implementation cycle is also variable, typically ranging from one to 24 months from contract execution to completion of implementation. The variability of our sales and implementation cycle is dependent on numerous factors, including the discretionary nature of potential clients' purchasing and budget decisions and the size and complexity of the applicable client. Some of our new-client set-up projects are complex and require a lengthy delay and significant implementation work, including to educate prospective clients about the uses and benefits of our solutions. Each customer’s situation is different, and unanticipated difficulties and delays may arise as a result of failure by us or by the client to meet our respective implementation responsibilities. During the implementation cycle, we expend substantial time, effort and financial resources implementing our service, but accounting principles do not allow us to recognize the resulting revenue until the service has been implemented, at which time we begin recognition of subscription and related implementation revenue over the life of the contract. This could harm our future operating results. If implementation periods are extended, our revenue cycle will be delayed and our financial condition may be adversely affected. In addition, cancellation of any implementation after it has begun may involve loss to us of time, effort and expenses invested in the cancelled implementation process and lost opportunity for implementing paying clients in that same period of time.

These factors may contribute to substantial fluctuations in our quarterly operating results, particularly in the near term and during any period in which our sales volume is relatively low. As a result, in future quarters our operating results could fall below the expectations of securities analysts or investors, in which event our stock price would likely decrease.

The growth of our business relies, in part, on the growth and success of our clients and certain revenues from our engagements, which is difficult to predict and is subject to factors outside of our control.

We enter into agreements with our healthcare services clients, under which a significant portion of our fees are variable, including fees which are dependent upon the number of add-on features subscribed for by our clients and the number of patients utilizing our payment processing tools. If there is a general reduction in spending by healthcare services organizations on healthcare technology solutions, it may result in a reduction in fees generated from our healthcare services clients or a reduction in the number of add-on features subscribed for by our healthcare services clients. This could lead to a decrease in our revenue, which could harm our business, financial condition and results of operations.

In addition, the number of patients utilizing our payment processing tools, and the amounts those patients pay directly to our healthcare services clients for services, is often impacted by factors outside of our control, such as the number of patients with high deductible health plans. Accordingly, revenue under these agreements can be uncertain and unpredictable. If the number of patients utilizing our payment systems, or the aggregate amounts paid by such patients directly to our healthcare services clients through our solutions, were to be reduced by a material amount, such decrease would lead to a decrease in our revenue, which could harm our business, financial condition and results of operations.

We also generate Network solutions revenue through fees charged to our life sciences and payer clients by delivering direct communications to help activate, engage and educate patients who authorize the delivery of, or "opt-in" to, such communications about topics critical to their health. The growth of our revenue stream from life sciences and payer clients is driven, in part, by our ability to grow our network of healthcare services clients and available population of patients to engage, our ability to achieve adequate patient opt-in rates, the number of newly approved drugs and the success of newly launched drugs, each of which is impacted by factors outside of our control. If there is a reduction in newly approved drugs, or newly launched drugs are not successful, this could negatively affect the ability of our life sciences clients to deliver relevant messages to patients who would have otherwise been candidates to receive such drugs, and accordingly may reduce patient opt-in rates. A reduction in the available population of patients to engage or a decline in patient opt-in rates or a lack of relevant content could lead to a decrease in our Network solutions revenue, which could harm our business, financial condition and results of operations.

If our existing clients are not satisfied with our services, it could have a material adverse effect on our business, financial condition, results of operations and reputation.

25

We depend on our existing clients’ satisfaction with our products and services. We expect to derive a significant portion of our revenue from renewal of existing clients’ contracts and sales of additional applications and services to existing clients. As part of our growth strategy, we have recently focused on expanding our services amongst current clients. As a result, achieving a high client retention rate, expanding within clients and selling additional applications and services are critical to our future business, revenue growth and results of operations. We also believe that maintaining and enhancing our reputation and brand recognition is critical to our relationships with existing clients and the patients that they serve and to our ability to attract new clients. The promotion of our brand may require us to make substantial investments, and we anticipate that, as our market becomes increasingly competitive, these marketing initiatives may become increasingly difficult and expensive. In addition, the loss or dissatisfaction of any client could substantially harm our brand and reputation, inhibit widespread adoption of our solutions and impair our ability to attract new clients.

Factors that may affect our client satisfaction and our ability to sell additional applications and services include, but are not limited to, the following:

•the price, performance and functionality of our solutions;

•patient acceptance and adoption of services and utilization of our payment processing tools;

•the availability, price, performance and functionality of competing solutions;

•our ability to develop and sell complimentary applications and services;

•the stability, performance and security of our hosting infrastructure and hosting services;

•changes in healthcare laws, regulations or trends;

•the business environment of our clients including healthcare staffing shortages and headcount reductions by our clients; and

•our ability to maintain and enhance our reputation and brand recognition.

We typically enter into annual contracts with our clients, which have a stated initial term of one year and automatically renew for one-year subsequent terms. Most of our clients have no obligation to renew their subscriptions for our solutions after the initial term expires. In addition, our clients may negotiate terms less advantageous to us upon renewal, which may reduce our revenue from these clients and may decrease our annual revenue. If our clients fail to renew their contracts, renew their contracts upon less favorable terms or at lower fee levels or fail to purchase new products and services from us, our revenue may decline or our future revenue growth may be constrained. Should any of our clients terminate their relationship with us after implementation has begun, we would not only lose our time, effort and resources invested in that implementation, but we would also have lost the opportunity to leverage those resources to build a relationship with other clients over that same period of time.

The estimates and assumptions we use to determine the size of our target market may prove to be inaccurate, and even if the markets in which we compete meet our size estimates and forecasted growth, our business may not grow at similar rates, or at all.

Market estimates and growth forecasts that we disclose are subject to significant uncertainty and are based on assumptions and estimates that may not prove to be accurate. The estimates and forecasts relating to the size and expected growth of the market for our services may prove to be inaccurate. These estimates and forecasts may be impacted by economic uncertainty that is outside our control, including international conflicts that may impact international trade and global economic performance and other macroeconomic trends, such as international and domestic supply chain risks, inflationary pressure, interest rate increases and declines in consumer confidence that impact our customers.

The principal assumptions relating to our market opportunity include the number of healthcare services organizations currently taking appointments, the amount of annual out of pocket consumer spend for healthcare-related services, and the amount of annual spend by life sciences and payer companies on direct communications with patients at the point of care. Our market opportunity is also based on the assumption that the strategic approach that Phreesia enables for our potential clients will be more attractive in creating efficiencies in patient care than competing solutions.

If these assumptions prove inaccurate, our business, financial condition and results of operations could be adversely affected.

If we cannot implement our solutions for clients or resolve any technical issues in a timely manner, we may incur costs in the form of service credits or other remedial steps and/or lose clients, and our reputation may be harmed.

26

Our clients utilize a variety of data formats, applications and infrastructure and we must support our clients’ data formats. Furthermore, the healthcare industry has shifted towards digitalized record keeping, and accordingly, many of our healthcare services clients have developed their own software, or utilize third-party software, for practice management and secure storage of electronic medical records. Our ability to develop and maintain logic-based and scalable technology for patient intake management and engagement and payment processing that successfully integrates with our clients’ software systems for practice management and storage of electronic medical records is critical. If we do not currently support a client’s required data format or appropriately integrate with clients’ systems, then we must configure our solutions to do so, which could increase our expenses. Additionally, we do not control our clients’ implementation schedules. As a result, if our clients do not allocate the internal resources necessary to meet their implementation responsibilities or if we face unanticipated implementation difficulties, the implementation may be delayed. If the client implementation process is not executed successfully or if execution is delayed, we could incur significant costs, clients could become dissatisfied and decide not to increase utilization of our services or not to implement our solutions beyond an initial period prior to their term commitment or, in some cases, revenue recognition could be delayed. In addition, competitors with more efficient operating models with lower implementation costs could jeopardize our client relationships.

Our clients and patients depend on our support services to resolve any technical issues relating to our solutions and our services, and we may be unable to respond quickly enough to accommodate short-term increases in demand for support services, particularly as we increase the size of our client bases (including healthcare services clients and the number of patients that they serve). We also may be unable to modify the format of our support services to compete with changes in support services provided by competitors. It is difficult to predict client and patient demand for technical support services, and if client or patient demand increases significantly, we may be unable to provide satisfactory support services to our clients. Further, if we are unable to address the needs of our clients and their patients in a timely fashion or further develop and enhance our solutions, or if a client or patient is not satisfied with the quality of work performed by us or with the technical support services rendered, then we could incur additional costs to address the situation or be required to issue credits or refunds for amounts related to unused services, and our profitability may be impaired and clients’ or patients’ dissatisfaction with our solutions could damage our ability to expand the number of applications and services purchased by such clients. These clients may not renew their contracts, seek to terminate their relationships with us or renew on less favorable terms. Moreover, negative publicity related to our client and patient relationships, or regarding patient confidentiality and privacy in the context of technology-enabled healthcare, regardless of its accuracy, may further damage our business by affecting our reputation or ability to compete for new business with current and prospective clients. If any of these were to occur, our revenue may decline and our business, financial condition and results of operations could be adversely affected.

We historically derive a significant portion of our revenues from our largest clients.

Historically, we have relied on a limited number of clients for a substantial portion of our total revenue and accounts receivable. The sudden loss of any of our larger clients, or the renegotiation of any of their contracts on less favorable terms, could adversely affect our operating results. Because we rely on a limited number of clients for a significant portion of our revenues, we depend on the creditworthiness of these clients. If the financial condition of our larger clients declines, our credit risk could increase. Should one or more of our significant clients declare bankruptcy, it could adversely affect the collectability of our accounts receivable and affect our bad debt reserves and net income.

Consolidation in the healthcare industry could have a material adverse effect on our business, financial condition and results of operations.

Many healthcare industry participants are consolidating to create larger and more integrated healthcare delivery systems with greater market power. We expect regulatory and economic conditions to result in additional consolidation in the healthcare industry in the future. As consolidation accelerates, the economies of scale of our clients’ organizations may grow. If a client experiences sizable growth following consolidation, it may determine that it no longer needs to rely on us and may reduce its demand for our products and services. In addition, as healthcare services organizations and life sciences companies consolidate to create larger and more integrated healthcare delivery systems with greater market power, these healthcare services organizations may try to use their market power to negotiate fee reductions for our products and services. Finally, consolidation may also result in the acquisition or future development by our healthcare services clients and life sciences clients of products and services that compete with our products and services. Any of these potential results of consolidation could have a material adverse effect on our business, financial condition and results of operations.

27

We depend on our senior management team and certain key employees, and the loss of one or more of our executive officers or key employees or an inability to attract and retain highly skilled employees could adversely affect our business.

Our success depends, in part, on the skills, working relationships and continued services of our founders, Chaim Indig (Chief Executive Officer) and Evan Roberts (Chief Operating Officer), and senior management team and other key personnel. From time to time, there may be changes in our senior management team resulting from the hiring or departure of executives, which could disrupt our business. In addition, our shift to a remote work environment could make it increasingly difficult to manage our business and adequately oversee our employees and business functions, potentially resulting in harm to our company culture, increased employee attrition, and the loss of key personnel.

In addition, we must attract, train and retain a significant number of highly skilled employees, including sales and marketing personnel, client support personnel, professional services personnel, software engineers, technical personnel and management personnel, and the availability of such personnel, in particular software engineers, may be constrained. We also believe that our future growth will depend on the continued development of our direct sales force and its ability to obtain new clients and to manage our existing client base. If we are unable to hire and develop sufficient numbers of productive direct sales personnel or if new direct sales personnel are unable to achieve desired productivity levels in a reasonable period of time, sales of our services will suffer and our growth will be impeded.

Competition for qualified management and employees in our industry is intense, and identifying and recruiting qualified personnel and training them requires significant time, expense and attention. Many of the companies with which we compete for personnel have greater financial and other resources than we do. While we have entered into offer letters or employment agreements with certain of our executive officers, all of our employees are “at-will” employees, and their employment can be terminated by us or them at any time, for any reason and without notice, subject, in certain cases, to severance payment rights. The departure and replacement of one or more of our executive officers or other key employees would likely involve significant time and costs, may significantly delay or prevent the achievement of our business objectives and could materially harm our business. In addition, volatility or lack of performance in our stock price may affect our ability to attract replacement should key personnel depart.

We have made, and may in the future make, acquisitions and investments which may be difficult to integrate, divert management resources, result in unanticipated costs or dilute our stockholders.

We have in the past acquired, and we may continue to acquire or invest in, businesses, products or technologies that we believe could complement or expand our products and services, enhance our market coverage or technical capabilities or otherwise offer growth opportunities. This may include acquiring or investing in companies, businesses, products or technologies that are tangential to our current business and/or in which we have limited or no prior operating experience.

There are inherent risks in integrating and managing acquisitions, and the pursuit of potential acquisitions may divert the attention of management and cause us to incur various expenses related to identifying, investigating and pursuing suitable acquisitions, whether or not they are consummated. We cannot assure you that we will realize the anticipated benefits of these or any future acquisitions. We also may not achieve the anticipated benefits from the acquired business due to a number of factors, including, without limitation:

•difficulty integrating the purchased operations, products or technologies and maintaining the quality and security standards consistent with our brand;

•the need to integrate or implement additional controls, procedures and policies;

•unanticipated costs or liabilities associated with the acquisition;

•our inability to comply with the regulatory requirements applicable to the acquired business;

•assimilation of the acquired businesses, which may divert significant management attention and financial resources from our other operations and could disrupt our ongoing business;

•use of substantial portions of our available cash or entail the issuance of our equity securities or the incurrence of debt to consummate the acquisition;

•the loss of key employees, particularly those of the acquired operations;

•difficulty retaining or developing the acquired business’ customers;

•adverse effects on our existing business relationships;

•failure to realize the potential cost savings or other financial benefits or the strategic benefits of the acquisitions, including failure to consummate any proposed or contemplated transaction; and

•liabilities from the acquired businesses for infringement of intellectual property rights or other claims and failure to obtain indemnification for such liabilities or claims.

28

Acquisitions also increase the risk of unforeseen legal liability, including for potential violations of applicable law or industry rules and regulations, arising from prior or ongoing acts or omissions by the acquired businesses which are not discovered by due diligence during the acquisition process. Acquisitions could also result in dilutive issuances of equity securities or the incurrence of debt, which could adversely affect our business, results of operations or financial condition. Even if we are successful in completing and integrating an acquired business, it may not perform as we expect or enhance the value of our business as a whole.

Certain of our operating results and financial metrics, including the key metrics included in this report, may be difficult to predict as a result of seasonality.

We believe there are significant seasonal factors that may cause us to record higher revenue in some quarters compared with others. We believe this variability is largely due to our focus on the healthcare industry. For example, with respect to our healthcare services clients, we receive a disproportionate increase in payment processing revenue from such clients during the first two to three months of the calendar year relative to the other months of the year, which is driven, in part, by the resetting of patient deductibles at the beginning of each calendar year. Sales for our life sciences solutions are also seasonal, primarily due to the annual spending patterns of our clients. This portion of our sales is usually the highest in the fourth quarter of each calendar year. While we believe we have visibility into the seasonality of our business, our rapid growth rate over the last several years may have made seasonal fluctuations more difficult to detect. If our rate of growth slows over time, seasonal or cyclical variations in our operations may become more pronounced, and our business, results of operations and financial position may be adversely affected.

Our risk management policies and procedures may not be fully effective in mitigating our risk exposure in all market environments or against all types of risk.

We operate in a rapidly changing industry. Accordingly, our risk management policies and procedures may not be fully effective to identify, monitor and manage all risks our business encounters. If our policies and procedures are not fully effective or we are not successful in identifying and mitigating all risks to which we are or may be exposed, we may suffer uninsured liability, harm to our reputation or be subject to litigation or regulatory actions that could adversely affect our business, financial condition or results of operations.

Our ability to limit our liabilities by contract or through insurance may be ineffective or insufficient to cover our future liabilities.

We attempt to limit, by contract, our liability for damages arising from our negligence, errors, mistakes or security breaches. Contractual limitations on liability, however, may not be enforceable or may otherwise not provide sufficient protection to us from liability for damages and we are not always able to negotiate meaningful limitations. We maintain liability insurance coverage, including coverage for cyber security and errors and omissions. It is possible, however, that claims could exceed the amount of our applicable insurance coverage, if any, or that this coverage may not continue to be available on acceptable terms or in sufficient amounts. Even if these claims do not result in liability to us, investigating and defending against them could be expensive and time-consuming and could divert management’s attention away from our operations. In addition, negative publicity caused by these events may delay market acceptance of our products and services, any of which could materially and adversely affect our reputation and our business.

We may become subject to litigation, which could have a material adverse effect on our business, financial condition and results of operations.

We may become subject to litigation in the future. Some of these claims may result in significant defense costs and potentially significant judgments against us, some of which we are not, or cannot be, insured against. We generally intend to defend ourselves vigorously; however, we cannot be certain of the ultimate outcomes of any claims that may arise in the future. Resolution of these types of matters against us may result in our having to pay significant fines, judgments or settlements, which, if uninsured, or if the fines, judgments and settlements exceed insured levels, could adversely impact our earnings and cash flows, thereby having a material adverse effect on our business, financial condition, results of operations, cash flow and per share trading price of our common stock. Certain litigation or the resolution of certain litigation may affect the availability or cost of some of our insurance coverage, which could adversely impact our results of operations and cash flows, expose us to increased risks that would be uninsured and adversely impact our ability to attract directors and officers.

Our operations in India will subject us to additional risks which could have an adverse effect on our business, operating results, and financial condition.

29

We have created a subsidiary in India to perform a number of functions currently performed by outside contractors. We expect to hire a significant number of employees from our outside contractor in India to bring these services in-house. While we believe our planned Indian operations will be advantageous to our business, they may also create risks that we must effectively manage. The continued management of our Indian operations will require significant management attention and financial resources that could adversely affect our operating performance. Wages in India are increasing at a faster rate than those in many countries, including the United States. In addition, with the significant increase in the numbers of foreign businesses that have established operations in India, the competition to attract and retain employees there has increased significantly. As a result, we may be unable to cost-effectively retain our current employee base in India or hire additional new talent. In addition, India has experienced significant inflation, low growth in gross domestic product and shortages of foreign exchange. India also has experienced civil unrest and terrorism and, in the past, has been involved in conflicts with neighboring countries. The occurrence of any of these circumstances could result in disruptions to our India operations, which, if continued for an extended period of time, could have a material adverse effect on our business. Further, conducting business abroad may subject us to increased legal and regulatory compliance and oversight. A failure to comply with applicable laws and regulations could result in regulatory enforcement actions, as well as substantial civil and criminal penalties assessed against us and our employees.

Our operating expenses incurred outside the United States and denominated in foreign currencies will increase as we expand our operations in India. Transactions denominated in foreign currencies are subject to fluctuations due to changes in foreign currency exchange rates. If we are not able to successfully hedge against the risks associated with foreign currency fluctuations, our financial condition and operating results could be adversely affected.

Risks relating to our payments business

If our payments platform is limited, restricted, curtailed or degraded in any way, or if we fail to continue to grow and develop our payments platform, our business may be materially and adversely affected.

Our payments platform is a core element of our business. For the fiscal year ended January 31, 2024, our payments platform generated 27% of our total revenue. Our future success depends in part on the continued growth and development of our payments platform. If such activities are limited, restricted, curtailed or degraded in any way, or if we fail to continue to grow and develop our payments platform, our business may be materially and adversely affected. The utilization of our payment processing tools may be impacted by factors outside of our control, such as disruptions in the payment processing industry generally. If the number of patients utilizing our payments platform, or the aggregate amounts paid by such patients directly to our healthcare services clients through our payments platform, were to be reduced as a result of disruptions in the payment processing industry or other factors, it could result in a decrease to our revenue, which could harm our business, financial condition and results of operations. In addition, some potential or existing clients may not desire to use our payment processing services or to switch from their existing payment processing vendors for a variety of reasons, such as transition costs, business disruption, and loss of accustomed functionality. There can be no assurance that our efforts to overcome these factors will be successful, and this resistance may adversely affect our growth.

The attractiveness of our payment processing services may also depend on our ability to integrate emerging payment technologies, including crypto-currencies, other emerging or alternative payment methods, and credit card systems that we or our processing partners may not adequately support or for which we or they do not provide adequate processing rates. In the event such methods become popular among consumers, any failure to timely integrate emerging payment methods (such as ApplePay) into our software, anticipate client behavior changes, or contract with payment processing partners that support such emerging payment technologies could reduce the attractiveness of our payment processing services, potentially resulting in a corresponding loss of revenue.

Increases in card network fees and other changes to fee arrangements may result in the loss of clients who use our payment processing services or a reduction in our earnings.

From time to time, card networks, including Visa, MasterCard, American Express and Discover, increase the fees that they charge acquirers, which would be passed down to processors, payment facilitators and merchants. We could attempt to pass these increases along to our clients, but this strategy might result in the loss of clients to competitors who do not pass along the increases. If competitive practices prevent us from passing along the higher fees to our clients in the future, we may have to absorb all or a portion of such increases, which may increase our operating costs and reduce our earnings.

If we fail to comply with the applicable requirements of card networks, they could seek to fine us, suspend

30

us or terminate our payment facilitator status. If our clients or sales partners incur fines or penalties that we cannot collect from them, we may have to bear the cost of such fines or penalties.

We provide a payments solution for the secure processing of patient payments. Our payment processing tools can connect to multiple clearinghouses and can also connect directly with patients. We have developed partnerships with primary credit card processors in the United States to facilitate payment processing, and we are registered with Visa, MasterCard, American Express, Discover and other card networks as a service provider (payment facilitator or the equivalent) for acquiring member institutions. These card networks set the operating rules and standards with which we must comply. The termination of our status as a certified service provider, a decision by the card networks to disallow payment facilitators or bar us from serving as such, or any changes in network rules or standards, including interpretation and implementation of the operating rules or standards, that increase the cost of doing business or limit our ability to provide transaction processing services to our clients or partners, could adversely affect our business, financial condition or results of operations.

We and our clients are subject to card network rules that could subject us or our clients to a variety of fines or penalties that may be levied by card networks for certain acts or omissions by us or our clients. If a client or sales partner fails to comply with the applicable requirements of card networks, we could be subject to a variety of fines or penalties that may be levied by card networks. We may have to bear the cost of such fines or penalties if we cannot collect them from the applicable client or sales partner, resulting in lower earnings or losses for us. Our violation of the network rules may result in the termination or suspension of our registration with the affected network. The termination of our registration, including a card network barring us from acting as a payment facilitator, or any changes in card network rules that would impair our registration, could require us to stop providing payment processing services relating to the affected card network, which would adversely affect our ability to conduct our business.

In addition, the rules of card networks are set by their boards, which may be influenced by card issuers. Many banks directly or indirectly sell processing services to clients in competition with us. These banks could attempt, by virtue of their influence on the networks, to alter the networks’ rules or policies to the detriment of non-members, including us.

Changes in laws and regulations relating to interchange fees on payment card transactions would adversely affect our revenue and results of operations.

We pay interchange fees to the card networks or the card issuers for each transaction we process. The card networks may increase, from time to time, the fees that they charge members or service providers. Although we may attempt to pass these increases along to our clients, this may result in the loss of clients to our competitors that do not pass along the increases. A provision of the Dodd-Frank Wall Street Reform and Consumer Protection Act (the "Dodd-Frank Act") known as the Durbin Amendment empowered the Board of Governors of the Federal Reserve System, ("FRS"), to establish and regulate a cap on the interchange fees that issuers (e.g. banks) may charge or receive for electronic clearing of debit card transactions. The original regulations implementing the Durbin Amendment established standards for assessing whether debit card interchange fees received by debit card issuers were reasonable and proportional to the costs incurred by issuers for electronic debit transactions, and it established a maximum permissible interchange fee that an issuer may receive for an electronic debit transaction, limiting the fee revenue to debit card issuers and payment processors. In November 2023, the FRS proposed amendments to Regulation II that would, if adopted as proposed, significantly lower the maximum permissible interchange fee for such transactions, and such maximum would be reevaluated every two years. To the extent that HSA-linked payment cards and other exempt payment cards (or their issuing banks, such as those having assets of less than $10 billion) lose their exempt status under the current rules, or if any interchange rate caps applicable to the debit card, credit card or other payment cards are changed, any such amendment, rule-making, or legislation could impact interchange rates applicable to payment card transactions processed through our payments platform. As a result, this could decrease our revenue and profit and could have a material adverse effect on our financial condition and results of operations.

Risk relating to our data and intellectual property

If our intellectual property is not adequately protected, we may not be able to build name recognition, protect our technology and products, and our business may be adversely affected.