10-K

Table of Contents

UNITED STATES

SECURITIES AND EXCHANGE COMMISSION

Washington, D.C. 20549

FORM 10-K

(Mark One)

For the fiscal year ended December 31, 2023

Commission File Number 001-39314

TALKSPACE, INC.

(Exact name of Registrant as specified in its Charter)

(Address of principal executive offices) (Zip Code)

Registrant’s telephone number, including area code: (212) 284-7206

Securities registered pursuant to Section 12(b) of the Act:

Title of each class Trading Symbol(s) Name of each exchange on which registered

Common stock, par value $0.0001 per share TALK The NASDAQ Stock Market LLC

Warrants to purchase common stock TALKW The NASDAQ Stock Market LLC

Securities registered pursuant to Section 12(g) of the Act:

Not Applicable

(Title of class)

Indicate by check mark if the Registrant is a well-known seasoned issuer, as defined in Rule 405 of the Securities Act. YES ☐ No ☒

Indicate by check mark if the Registrant is not required to file reports pursuant to Section 13 or 15(d) of the Act. YES ☐ No ☒

Indicate by check mark whether the Registrant: (1) has filed all reports required to be filed by Section 13 or 15(d) of the Securities Exchange Act of 1934 during the preceding 12 months (or for such shorter period that the Registrant was required to file such reports), and (2) has been subject to such filing requirements for the past 90 days. Yes ☒ NO ☐

Table of Contents

Indicate by check mark whether the Registrant has submitted electronically every Interactive Data File required to be submitted pursuant to Rule 405 of Regulation S-T (§232.405 of this chapter) during the preceding 12 months (or for such shorter period that the Registrant was required to submit such files). Yes ☒ NO ☐

Indicate by check mark whether the registrant is a large accelerated filer, an accelerated filer, a non-accelerated filer, a smaller reporting company, or an emerging growth company. See the definitions of “large accelerated filer,” “accelerated filer,” “smaller reporting company,” and “emerging growth company” in Rule 12b-2 of the Exchange Act.

Large accelerated filer ☐ Accelerated filer ☒

Non-accelerated filer ☐ Smaller reporting company ☒

Emerging growth company ☐

If an emerging growth company, indicate by check mark if the registrant has elected not to use the extended transition period for complying with any new or revised financial accounting standards provided pursuant to Section 13(a) of the Exchange Act. ☐

Indicate by check mark whether the registrant has filed a report on and attestation to its management’s assessment of the effectiveness of its internal control over financial reporting under Section 404(b) of the Sarbanes-Oxley Act (15 U.S.C. 7262(b)) by the registered public accounting firm that prepared or issued its audit report. ☒

If securities are registered pursuant to Section 12(b) of the Act, indicate by check mark whether the financial statements of the registrant included in the filing reflect the correction of an error to previously issued financial statements. ☐

Indicate by check mark whether any of those error corrections are restatements that required a recovery analysis of incentive-based compensation received by any of the registrant’s executive officers during the relevant recovery period pursuant to §240.10D-1(b). ☐

Indicate by check mark whether the Registrant is a shell company (as defined in Rule 12b-2 of the Act). YES ☐ NO ☒

The aggregate market value of the voting common stock held by non-affiliates of the Company on June 30, 2023 was $181.8 million based on the per share closing price of the Company's common stock on June 30, 2023 of $1.27.

The number of shares of common stock outstanding on March 12, 2024 was 168,903,571.

DOCUMENTS INCORPORATED BY REFERENCE

The Company's definitive Proxy Statement for the 2024 Annual Meeting of Stockholders to be filed by the Company pursuant to Regulation 14A is incorporated into Items 10, 11, 12, 13 and 14 of Part III of this Form 10-K.

Table of Contents

Page

PART I

Item 1. Business 2

Item 1A. Risk Factors 12

Item 1B. Unresolved Staff Comments 40

Item 1C. Cybersecurity 41

Item 2. Properties 43

Item 3. Legal Proceedings 43

Item 4. Mine Safety Disclosures 43

PART II

Item 6. Reserved 45

Item 7A. Quantitative and Qualitative Disclosures About Market Risk 55

Item 8. Financial Statements and Supplementary Data 56

Item 9A. Controls and Procedures 79

Item 9B. Other Information 80

Item 9C. Disclosure Regarding Foreign Jurisdictions that Prevent Inspections 80

PART III

Item 10. Directors, Executive Officers and Corporate Governance 81

Item 11. Executive Compensation 81

Item 14. Principal Accounting Fees and Services 81

PART IV

Item 15. Exhibits and Financial Statement Schedules 82

Exhibit Index 83

Signatures 85

Table of Contents

PART I

Item 1. BUSINESS

Our Mission

Our mission is to help people everywhere to heal.

Overview

Talkspace, Inc. together with its consolidated subsidiaries (referred to herein as the “Company”, “we”, “our”, “us” or “Talkspace”) is a leading behavioral healthcare company that offers convenient and affordable access to a fully-credentialed network of licensed therapists, psychologists, and psychiatrists. Founded in 2012, and enabled by a purpose-built technology platform, we have connected millions of patients, who we refer to as our “members” with licensed mental health providers through messaging, video and audio.

Talkspace was originally incorporated as Hudson Executive Investment Corp. (“HEC”), a special purpose acquisition company, for the purpose of entering into a business combination with one or more businesses or entities. On January 12, 2021, HEC, entered into an Agreement and Plan of Merger, dated as of January 12, 2021 (the “Merger Agreement”), with Groop Internet Platform, Inc. (“Old Talkspace”), Tailwind Merger Sub I, Inc., a Delaware corporation and a direct wholly owned subsidiary of HEC (“First Merger Sub”), and Tailwind Merger Sub II, LLC, a Delaware limited liability company (“Second Merger Sub”). On June 22, 2021, as contemplated by the Merger Agreement, First Merger Sub merged with and into Old Talkspace (the “First Merger”) with Old Talkspace surviving the First Merger, and immediately following the First Merger and as part of the same overall transaction as the First Merger, Old Talkspace merged with and into Second Merger Sub, with Second Merger Sub surviving the merger as a wholly owned subsidiary of HEC. The Company refers to this transaction as the Business Combination. In connection with the Business Combination, HEC filed the Certificate of Incorporation and changed its name to “Talkspace, Inc.”

Through our platform, we serve our payor clients ("Payor"), comprised of health plans and employee assistance programs such as Aetna, Cigna, and Optum, who offer their insured members access to our platform at in-network reimbursement rates, our Direct-to-Enterprise clients ("DTE"), comprised of enterprises such as Google and the University of Kentucky who offer their enterprise members access to our platform while their enterprise is under an active contract with Talkspace, and individual subscribers ("Consumer") who subscribe directly to our platform; (collectively, our "clients").

Through our psychotherapy offerings, our licensed therapists and counselors treat mental health conditions in over 21 specializations, such as depression, anxiety, trauma and other fields of human challenges. Through our psychiatry offerings, our board-certified psychiatrists and prescription-eligible nurse practitioners treat a higher acuity patient demographic, including those who may have pharmacological needs. Our psychiatry clinicians, may in their discretion, refer the member to a primary care provider or face-to-face psychiatrist if the clinical need arises, including to address potential needs for “controlled substances.” Talkspace does not prescribe controlled substances in accordance with the Drug Enforcement Administration (“DEA”) Ryan Haight Act.

We have a vast nationwide network of fully-credentialed providers across all 50 U.S. states. Our network is sustained and enhanced by an attractive value proposition to providers, including flexibility, convenience, efficiency, professional development opportunities and income. We also believe that our platform provides other benefits to providers through expanded reach, steady access to member leads, reduced administrative burdens, more efficient time utilization and data-driven insights. We designed our provider network to be scalable and to leverage a hybrid model of both employee providers and independently contracted providers to support multiple growth scenarios.

Our network has the power to deliver an enhanced care journey, higher member lifetime engagement and meaningful outcomes for our clients, as well as generally greater margins when compared to face-to-face treatment. In pursuing our mission of helping people everywhere to heal, we aim to provide our members with high-quality behavioral healthcare via coverage through a health plan, employee access program, or enterprise benefit or whether they are paying for the service directly.

Table of Contents

For the year ended December 31, 2023 our revenues were $150.0 million compared to $119.6 million for the year ended December 31, 2022. As of December 31, 2023, we had approximately 131 million eligible lives through our Payor and DTE clients and approximately 11,700 Consumer active members compared to 92 million eligible lives and 15,400 Consumer active members as of December 31, 2022. Completed sessions for members covered under our Payor clients during the year ended December 31, 2023 were approximately 850,600 compared to 426,400 completed sessions for the year ended December 31, 2022.

Our Offerings

By seeking to eliminate barriers in accessing and utilizing mental healthcare and offering providers technology-enabled tools to provide high-quality clinical care with a data-driven approach to treatment, we offer our members a robust ecosystem for end-to-end behavioral healthcare. Our offerings include psychotherapy and psychiatry services.

Psychotherapy: In psychotherapy, or “talk therapy,” members work with a licensed therapist or counselor to treat specific mental health conditions like depression or anxiety, trauma and other human challenges, including by developing positive thinking and coping skills. We offer text, audio and video-based psychotherapy from licensed therapists.

Psychiatry: In psychiatry, members receive personalized, expert care from a prescriber who specializes in mental healthcare and prescription management. Typical packages include one initial video consultation, with follow-up video appointments as needed. Like the traditional face-to-face model, Talkspace providers can prescribe medication they deem necessary up and until the point, that in the providers discretion, the member requires a face-to-face provider for potential need of those prescriptions labeled a “controlled substance” under the federal Controlled Substances Act. Our psychiatry services are comprised of board-certified psychiatrists, as well as prescription-eligible nurse practitioners who may supplement the psychiatrist in follow-up visits and act in a medication management capacity.

Our Customers

In pursuit of our mission to expand access to all individuals in need of behavioral services, we strive to deliver effective care to a broad range of customers.

Through Talkspace Behavioral Health plan ("BH") and Talkspace Employee Assistance Program ("EAP) or Payor, we contract with a number of U.S. health plans to provide online therapy to insured members. Through Talkspace for Business or DTE, enterprise members access our platform services on a benefit plan paid by their enterprise.

•

Payor clients: Through our BH offering, our members receive care directly covered through their individual health plan where our providers are considered in-network. Through our EAP offering, we contract with major Payor clients who are contracted with enterprises to deliver care. Through this solution, we are able to provide therapy and psychiatry services to our clients’ members, who then pay a flat rate per session or interaction, of which we receive a portion of the fee. A representative sample of our health plan clients include Aetna, Cigna and Optum.

•

DTE clients: Through our DTE offering, we contract directly with enterprises to provide their enterprise members unlimited synchronous and asynchronous care primarily on a per-member-per-month (“PMPM”) basis. Enterprises can include employers, academic organizations, higher education, and government entities. Through our contracts we provide mental health solutions to enterprise members which includes employees, teens, students and student athletes. A representative sample of our enterprise clients include Google, the University of Kentucky and the New York City Department of Health and Mental Hygiene.

As of December 31, 2023, we had approximately 131 million eligible lives within our Payor and DTE clients. See Note 2, “Summary of Significant Accounting Policies and Estimates” in the notes to the consolidated financial statements for more details on the Company's contractual agreements.

Within our Consumer members, we serve a diverse customer base, with members from all socioeconomic backgrounds, ages, genders, ethnicities, geographies and income level. Further, with both psychotherapy and psychiatry professionals, along with a comprehensive suite of self-help tools, our platform is designed to address the needs of members across a broad range of acuities. As of December 31, 2023, we had approximately 11,700 Consumer active members located across all 50 U.S. states and select international markets. Consumer active members may cancel their subscription at any time and will receive a pro-rata refund for the subscription price.

Table of Contents

Technology Platform

We believe that virtual therapy offers an attractive opportunity to improve behavioral health through data science and machine learning. Through digital phenotyping and predictive modeling, the data imprint left by interactions on our platform opens a new, quantitative viewpoint into the behavioral condition of our members. By securely leveraging our unique dataset to identify patterns, which is augmented by advanced, data-driven tools to personalize care, we believe we are able to optimize clinical outcomes. We have designed our technology platform and information practices to achieve and maintain compliance with HIPAA and other legal requirements regarding the confidentiality of patient information. We maintain a written privacy and information security management program, led by designated subject matter experts, in order to (i) limit how we use and disclose protected health information of the members who utilize our technology platform or therapeutic services, (ii) implement reasonable administrative, physical, and technical safeguards to protect such information from misuse or cyber-attacks, and (iii) assist our customers with certain duties such as access to information under the privacy standards, among other program elements. We require our agents and subcontractors who have access to such information to enter into written agreements that require them to meet the same standards for security and privacy. We obtain third-party examinations of our controls relating to security and data privacy. In particular, we regularly obtain a Type II Service Organization Control SOC 2 report (Reporting on Controls at a Service Organization relevant to security, availability and privacy). We also retain outside consultants to regularly assess our vulnerability through penetration testing and analysis of our compliance with the HIPAA Security Rule.

The following table depicts the technology-enabled process flow that supports our platform:

Matching algorithm: We utilize machine learning to predict a provider’s efficacy at onboarding. Our matching algorithm combines information from both structured and unstructured sources to predict which therapists have the greatest chance of success with each patient. Our matching model concurrently gathers client and therapist data and screens the therapists’ population to match the patient’s characteristics, clinical needs and preferences. Our machine learning technology also enables us to track the frequency and quality of clinical interactions, allowing us to provide a better therapist match should the patient request a new clinician.

Robust data ecosystem: We have a closed-loop data ecosystem providing a multi-dimensional view of the individuals who seek treatment on our platform. This data provides a holistic picture of each user – the problems they manifest, diagnoses, treatment plans, medical history, personal history, and clinical outcomes. Our data contains over 7.2 billion words sent by millions of users over 127 million anonymized messages. We have approximately 5 million completed psychological assessments. Our data contains information about members collected by therapists, including approximately 1 million diagnoses and over 2.8 million progress and psychotherapy notes. Our data also contains information about therapists reported by members, including over 2.1 million therapist ratings. We believe the size and depth of our clinical data is vast relative to the industry and is a differentiating element of our digitally-native modality.

Empowering providers to deliver enhanced care: Our providers are equipped with tools that allow them to optimize time utilization and improve clinical efficacy. One of the leading challenges in behavioral healthcare is a patient’s premature termination of engagement with the provider and, thus, a core focus of our machine learning strategy is to drive member

Table of Contents

engagement and increase care continuity, helping members to continue treatment long enough to reap its benefits. In order to extend the lifetime duration of our member base, we provide our providers insights on their patients’ needs and behaviors and offer techniques and suggestions that we believe are likely to maximize their patients’ satisfaction and engagement. These insights, delivered through our fully-integrated data intelligence platform, help providers to deliver effective treatments to their patients, and raise members’ awareness when tracking their own clinical progress.

Performance tracking and feedback: Our “Intro and Expectations” system detects whether providers have followed best practices in the crucial introductory phase of the therapy relationship and reminds them to do so if they have not. Our “Crisis Risk system” monitors all incoming members’ messages for linguistic features associated with potential danger or self-harm and draws providers’ attention to these cases. Our “Session Highlights system” provides a weekly digest of patient messages and helps therapists draft notes on clinical progress.

Competition

We view as competitors those companies whose primary business is developing and marketing telehealth and virtual behavioral health platforms and services. Competition focuses on, among other factors, technology, breadth and depth of functionality, range of associated services, operational experience, customer support, extent of client and member bases, and reputation. Our key competitors in the telehealth and teletherapy markets are American Well Corporation, Teladoc, Lyra Health and Spring Health, among other small industry participants.

In addition, large, well-financed health systems and health plans have in some cases developed their own virtual behavioral health tools and may provide these solutions to their consumers at discounted prices. In the future we may face competition from large technology companies, such as Apple, Amazon, Meta, Verizon, or Microsoft, who may wish to develop their own virtual behavioral health solutions, as well as from large retailers like Amazon or Walmart. We believe that the breadth of our existing client and member bases, the depth of our technology platform, and our business-to-business focus on promoting existing healthcare brands and integrating freely with multiple platforms increases the likelihood that stakeholders seeking to develop virtual behavioral healthcare solutions will choose instead to collaborate with Talkspace.

Therapists, Physicians and Healthcare Professionals

In the second quarter of 2022, we completed the transition of our structure with respect to our relationships with healthcare providers, transitioning to a structure where Talkspace LLC, our wholly-owned subsidiary, has entered into various agreements with Talkspace Provider Network, PA ("TPN"), a Texas professional association entity, which in turn contracts with our other affiliated professional entities ("PC entities"), physicians, therapists, and other licensed professionals for clinical and professional services provided to our members. As part of this transition, Talkspace LLC is party to various Management Services Agreements (“MSAs”) with TPN and the PC entities. Pursuant to the MSAs, Talkspace LLC is the managing entity (the “Manager”) and provides management and administrative resources and services essential to the operations of these entities and receives a management fee for these services and reimbursement of expenses incurred. TPN and the PC entities in turn have the obligation under the MSAs to engage all licensed physicians and other health professionals to provide behavioral healthcare services to our members.

The transition to a structure where we operate under various MSAs with professional associations and professional corporations authorized by state law to contract with affiliated professionals to delivery teletherapy services to its members helps ensure we are able to comply with all applicable regulatory requirements, including the corporate practice of medicine and fee-splitting laws, that are necessarily implicated by engaging in telehealth care that can only be delivered by physicians. The Company is continuing to transition its current agreements with its clients, members and other business partners to TPN and/or the PC entities, where applicable.

See Note 12, “Variable Interest Entities” in the notes to the consolidated financial statements for further details.

Table of Contents

Human Capital Overview

The Company’s workforce is critical to the creation and delivery of its services and the success of the company. Our ability to attract, develop and retain talented employees with the skills and capabilities needed by our business is a key component of our long-term growth and our mission of providing more people with convenient access to quality, affordable behavioral healthcare.

The Company views full-time employees and independently contracted providers as its total workforce, and each are eligible for the various formal and informal programs and resources to support, recruit, train and retain its workforce. The Company's human capital network includes, but is not limited to, employee and independently contracted providers (licensed therapists, psychologists, psychiatrists), as well as employees in various support functions throughout the Company. The human capital needs and strategy of our business is overseen by the Company's Board of Directors and Chief Executive Officer and supported by the Company’s Human Resources Department, which reports directly to the Chief Executive Officer.

As of December 31, 2023, we had 472 employees comprised of 252 providers and 220 professionals supporting the accounting, finance, technology, sales, marketing and other support functions and 5,235 independently contracted providers. With providers comprising a considerable segment of the Company’s workforce, they are a significant human capital resource for the Company, and, accordingly, we view their recruitment, retention, compensation and productivity as important to the success of the Company.

Culture and Values

Tone at the top is what drives us. We are committed to maintaining a respectful, secure and supportive workplace culture with open communication and accessible, safe channels for feedback. In addition, all employees are required to complete training and affirm compliance with the Talkspace Code of Business Conduct and Ethics (the “Code”), which confirms the Company’s policy to conduct its affairs in compliance with all applicable laws and regulations and observe the highest standards of business ethics. The Code is reviewed regularly by the Audit Committee and approved by the Board of Directors and is complemented by other policies and training. Any violations of our Code are encouraged to be immediately reported and are kept anonymously.

Diversity and Inclusion

Talkspace is committed to creating and maintaining a workplace in which all employees have an opportunity to participate and contribute to the success of the business. Talkspace provides equal employment opportunities to all employees and applicants for employment without regard to race, color, ancestry, national origin, gender, sexual orientation, marital status, religion, age, disability, gender identity, results of genetic testing, or service in the military. Equal employment opportunity applies to all terms and conditions of employment, including hiring, placement, promotion, separation, transfers, compensation, and training. The Company is committed to cultivating diversity and broadening opportunities for inclusion across its business through its recruitment practices, employee development and mentoring and inclusivity programs.

Compensation and Benefits

The Company is committed to hiring the most qualified candidates to fill open positions. Whenever appropriate and possible, open positions are filled with internal candidates to help team members in their career development and enrich a culture of growth. Compensation and benefits programs are focused on attracting, retaining and motivating the top talent necessary to achieve the Company’s mission in ways that reflect its diverse workforce’s needs and priorities. In addition to competitive salaries, the Company and its businesses have established short and long-term incentive programs including stock-based compensation awards and cash-based performance bonus awards, which are designed to motivate and reward performance against key business objectives and facilitate retention. Performance bonus allocations are provided based on the organization meeting its financial goals, the employee achieving goals set by their supervisor, and per the employment agreements and/or any other written agreement. In addition, the Company provides retirement benefits and other comprehensive benefit options to meet the needs of its employees, including healthcare benefits, tax advantaged savings vehicles, life and disability insurance, paid time off, flexible working arrangements, generous parental leave policies and access to wellness programs.

Table of Contents

Training and Development

Our growth mindset culture begins with valuing learning over knowing – seeking out new ideas, driving innovation, embracing challenges, learning from failure, and improving over time. The Company strives to provide mentorship and career development to existing employees to help everyone on the team reach their full potential and employees are encouraged to reach out to their supervisors if further development training is needed. In addition, the Company provides ongoing training in areas related to HIPAA, Cybersecurity, Security and Privacy Controls, Fraud Waste, and Abuse and Anti-Harassment and Discrimination training, among others.

U.S. Government Regulation

Our operations are subject to comprehensive United States federal, state and local and international regulation in the jurisdictions in which we do business. Our ability to operate profitably will depend in part upon our ability, and that of our affiliated providers, to maintain all necessary licenses and to operate in compliance with applicable laws and rules. Those laws and rules continue to evolve and can become more restrictive, and we therefore devote significant resources to monitoring developments in healthcare and medical practice regulation. As the applicable laws and rules change, we are likely to make conforming modifications in our business processes from time to time. In some jurisdictions where we operate, neither our current nor our anticipated business model has been the subject of formal judicial or administrative interpretation. We cannot be assured that a review of our business by courts or regulatory authorities will not result in determinations that could adversely affect our operations or that the healthcare regulatory environment will not change in a way that impacts our operations.

For an additional discussion of our regulatory environment, see “Risk Factors—Risk Related to Our Legal and Regulatory Environment” included in Part I, Item 1A of this Annual Report on Form 10-K.

Telehealth and Teletherapy Provider Licensing, Medical Practice, Certification and Related Laws and Guidelines

The practice of medicine, including the provision of therapy services, is subject to various federal, state and local certification and licensing laws, regulations, approvals and standards, relating to, among other things, the adequacy of medical care, the practice of medicine and licensed professional services (including the provision of remote care), equipment, personnel, operating policies and procedures and the prerequisites for the prescription of medication and ordering of tests. The application of some of these laws to telehealth and teletherapy is unclear and subject to differing interpretations.

Physicians, therapists and other licensed professionals who provide professional medical and therapy services to a patient via telehealth and teletherapy must, in most instances, hold a valid license to practice medicine or another licensed profession in the state in which the patient is located. We have established systems for ensuring that our affiliated professionals are appropriately licensed under applicable state law and that their provision of telehealth and teletherapy to our members occurs in each instance in compliance with applicable rules governing telehealth and teletherapy. Failure to comply with these laws and regulations could result in licensure actions against the professionals, our services being found to be non-reimbursable, or prior payments being subject to recoupments and can give rise to civil, criminal or administrative penalties.

Corporate Practice of Medicine Laws in the U.S.; Fee Splitting

We contract with physicians or physician owned professional associations, professional corporations and therapists to provide access to our platform and to provide therapy to their patients. We have entered into MSAs with TPN and the PC entities pursuant to which we provide billing, scheduling and a wide range of other administrative and management services in exchange for management and other service fees. These contractual relationships are subject to various state laws that prohibit fee splitting or the corporate practice of medicine or professional services by lay entities or persons and that are intended to prevent unlicensed persons from interfering with or influencing a physician’s or another licensed professional’s clinical judgment. Activities other than those directly related to the delivery of healthcare may be considered an element of the practice of medicine in many states. Under the corporate practice of medicine and other licensed profession restrictions of certain states, decisions and activities such as contracting, setting rates and the hiring and management of personnel may implicate the restrictions on the corporate practice of medicine or other licensed profession.

Table of Contents

State corporate practice of medicine or other licensed professions and fee splitting laws and rules vary from state to state. In addition, these requirements are subject to broad interpretation and enforcement by state regulators. Some of these requirements may apply to us even if we do not have a physical presence in the state, based solely on our engagement of a provider licensed in the state or the provision of telehealth and teletherapy to a resident of the state. Thus, regulatory authorities or other parties, including our providers, may assert that, despite these arrangements, we are engaged in the corporate practice of medicine or a licensed profession or that our contractual arrangements with affiliated providers constitute unlawful fee splitting. In such event, failure to comply could lead to adverse judicial or administrative action against us and/or our affiliated providers, civil, criminal or administrative penalties, receipt of cease and desist orders from state regulators, loss of provider licenses, the need to make changes to the terms of engagement of our providers that interfere with our business, and other materially adverse consequences.

U.S. Federal and State Fraud and Abuse Laws

Federal Stark Law

If in the future some of our revenues come from federal healthcare programs, we will be subject to the federal self-referral prohibitions, commonly known as the Stark Law. Where applicable, this law prohibits a physician from referring Medicare patients to an entity providing “designated health services” such as laboratory and other diagnostic services and prescription drugs that are furnished at an entity if the physician or a member of such physician’s immediate family has a “financial relationship” with the entity, unless an exception applies. Sanctions for violating the Stark Law include denial of payment, civil monetary penalties of up to $26,125 per claim submitted and twice the value of each such service and exclusion from the federal healthcare programs. Failure to refund amounts received as a result of a prohibited referral on a timely basis may constitute a false or fraudulent claim and may result in civil penalties and additional penalties under the federal False Claims Act (“FCA”). The statute also provides for a penalty of up to $174,172 for a circumvention scheme. The Stark Law is a strict liability statute, which means proof of specific intent to violate the law is not required. In addition, the government and some courts have taken the position that claims presented in violation of the various statutes, including the Stark Law, can be considered a violation of the FCA (described below) based on the contention that a provider impliedly certifies compliance with all applicable laws, regulations and other rules when submitting claims for reimbursement. A determination of liability under the Stark Law for TPN, the PC entities or our affiliated physicians could have a material adverse effect on our business, financial condition and results of operations.

Federal Anti-Kickback Statute

We will also be subject to the federal Anti-Kickback Statute if any of our services become reimbursable by government healthcare programs. The Anti-Kickback Statute is broadly worded and prohibits the knowing and willful offer, payment, solicitation or receipt of any form of remuneration in return for, or to induce, (i) the referral of a person covered by Medicare, Medicaid or other governmental programs, (ii) the furnishing or arranging for the furnishing of items or services reimbursable under Medicare, Medicaid or other governmental programs or (iii) the purchasing, leasing or ordering or arranging or recommending purchasing, leasing or ordering of any item or service reimbursable under Medicare, Medicaid or other governmental programs. Certain federal courts have held that the Anti-Kickback Statute can be violated if “one purpose” of a payment is to induce referrals. In addition, a person or entity does not need to have actual knowledge of this statute or specific intent to violate it to have committed a violation, making it easier for the government to prove that a defendant had the requisite state of mind or “scienter” required for a violation. Moreover, the government may assert that a claim including items or services resulting from a violation of the Anti-Kickback Statute constitutes a false or fraudulent claim for purposes of the FCA, as discussed below. Violations of the federal Anti-Kickback Statute may result in civil monetary penalties up to $105,563 for each violation, plus up to three times the remuneration involved. Civil penalties for such conduct can further be assessed under the FCA. Violations of the federal Anti-Kickback Statute can also result in criminal penalties, including criminal fines of more than $100,000 and imprisonment of up to 10 years. Similarly, violations can result in exclusion from participation in government healthcare programs, including Medicare and Medicaid. Imposition of any of these remedies could have a material adverse effect on our business, financial condition and results of operations, if in the future we provide services reimbursable by government healthcare programs. In addition to a few statutory exceptions, the Office of Inspector General (“OIG”) has published safe-harbor regulations that outline categories of activities that are deemed protected from prosecution under the Anti-Kickback Statute provided all applicable

Table of Contents

criteria are met. The failure of a financial relationship to meet all of the applicable safe harbor criteria does not necessarily mean that the particular arrangement violates the Anti-Kickback Statute. However, conduct and business arrangements that do not fully satisfy each applicable safe harbor may result in increased scrutiny by government enforcement authorities, such as the OIG.

False Claims Act

Both federal and state government agencies have continued civil and criminal enforcement efforts as part of numerous ongoing investigations of healthcare companies and their executives and managers. Although there are a number of civil and criminal statutes that can be applied to healthcare providers, a significant number of these investigations involve the FCA. These investigations can be initiated not only by the government but also by a private party asserting direct knowledge of fraud. These “qui tam” whistleblower lawsuits may be initiated against any person or entity alleging such person or entity has knowingly or recklessly presented, or caused to be presented, a false or fraudulent request for payment from the federal government or has made a false statement or used a false record to get a claim approved. In addition, the improper retention of an overpayment for 60 days or more is also a basis for an FCA action, even if the claim was originally submitted appropriately. Penalties for FCA violations include fines ranging from $13,508 to $27,018 for each false claim, plus up to three times the amount of damages sustained by the federal government. An FCA violation may provide the basis for exclusion from the federally funded healthcare programs.

State Fraud and Abuse Laws

Several states in which we operate have also adopted or may adopt similar self-referral, anti-kickback, fraud, whistleblower and false claims laws as described above. The scope of these laws and the interpretations of them vary by jurisdiction and are enforced by local courts and regulatory authorities, each with broad discretion. Some state fraud and abuse laws apply to items or services reimbursed by Medicaid programs and any third-party payer, including commercial insurers or to any payer, including to funds paid out of pocket by a patient. A determination of liability under such state fraud and abuse laws could result in fines and penalties and restrictions on our ability to operate in these jurisdictions.

Other Healthcare Laws

FCA established several separate criminal penalties for making false or fraudulent claims to insurance companies and other non-governmental payers of healthcare services. Under FCA, these two additional federal crimes are: “Healthcare Fraud” and “False Statements Relating to Healthcare Matters.” The Healthcare Fraud statute prohibits knowingly and recklessly executing a scheme or artifice to defraud any healthcare benefit program, including private payers. A violation of this statute is a felony and may result in fines, imprisonment, or exclusion from government sponsored programs. The False Statements Relating to Healthcare Matters statute prohibits knowingly and willfully falsifying, concealing, or covering up a material fact by any trick, scheme or device or making any materially false, fictitious, or fraudulent statement in connection with the delivery of or payment for healthcare benefits, items, or services. A violation of this statute is a felony and may result in fines or imprisonment. This statute could be used by the government to assert criminal liability if a healthcare provider knowingly fails to refund an overpayment. These provisions are intended to punish some of the same conduct in the submission of claims to private payers as the federal False Claims Act covers in connection with governmental health programs. In addition, the Civil Monetary Penalties Law imposes civil administrative sanctions for, among other violations, inappropriate billing of services to federally funded healthcare programs and employing or contracting with individuals or entities who are excluded from participation in federally funded healthcare programs. Moreover, a person who offers or transfers to a Medicare or Medicaid beneficiary any remuneration, including waivers of copayments and deductible amounts (or any part thereof), that the person knows or should know is likely to influence the beneficiary’s selection of a particular provider, practitioner or supplier of Medicare or Medicaid payable items or services may be liable for civil monetary penalties of up to $10,000 for each wrongful act. Furthermore, in certain cases, providers who routinely waive copayments and deductibles for Medicare and Medicaid beneficiaries can also be held liable under the Anti-Kickback Statute and civil False Claims Act, which can impose additional penalties associated with the wrongful act. One of the statutory exceptions to the prohibition is non-routine, unadvertised waivers of copayments or deductible amounts based on individualized determinations of financial need or exhaustion of reasonable collection efforts. The OIG emphasizes, however, that this exception should only be used occasionally to address special financial needs of a particular patient. Although this prohibition applies only to federal healthcare program beneficiaries, the routine waivers of copayments and deductibles offered to patients covered by commercial payers may implicate applicable state laws related to, among other things, unlawful schemes to defraud, excessive fees for services, tortious interference with patient contracts, and statutory or common law fraud.

Table of Contents

U.S. State and Federal Health Information Privacy and Security Laws

There are numerous U.S. federal and state laws and regulations related to the privacy and security of personal information, including health information. In particular, HIPAA imposes a number of requirements on covered entities and their business associates relating to the use, disclosure and safeguarding of protected health information. These requirements include uniform standards of common electronic healthcare transactions; privacy and security regulations; and unique identifier rules for employers, health plans and providers. In addition, the Health Information Technology for Economic and Clinical Health Act, or HITECH, provisions of the American Recovery and Reinvestment Act of 2009 and corresponding implementing regulations have imposed additional requirements on the use and disclosure of protected health information such as additional breach notification and reporting requirements, contracting requirements for HIPAA business associate agreements, strengthened enforcement mechanisms and increased penalties for HIPAA violations. Federal consumer protection laws may also apply in some instances to privacy and security practices related to personal information.

Violations of HIPAA may result in civil and criminal penalties. However, a single breach incident can result in violations of multiple standards. Our management responsibilities to TPN and the PC entities include assisting it with its obligations under HIPAA’s breach notification rule. Under the breach notification rule, covered entities must notify affected individuals without unreasonable delay in the case of a breach of unsecured protected health information (“PHI”), which may compromise the privacy, security or integrity of the PHI. In addition, notification must be provided to the U.S. Department of Health and Human Services (“HHS”) and the local media in cases where a breach affects more than 500 individuals. Breaches affecting fewer than 500 individuals must be reported to HHS on an annual basis. HIPAA also requires a business associate to notify its covered entity clients of breaches by the business associate.

State attorneys general also have the right to prosecute HIPAA violations committed against residents of their states. While HIPAA does not create a private right of action that would allow individuals to sue in civil court for a HIPAA violation, its standards have been used as the basis for the duty of care in state civil suits, such as those for negligence or recklessness in misusing personal information. In addition, HIPAA mandates that HHS conduct periodic compliance audits of HIPAA covered entities and their business associates for compliance. It also tasks HHS with establishing a methodology whereby harmed individuals who were the victims of breaches of unsecured PHI may receive a percentage of the civil monetary penalty fine paid by the violator. In light of the HIPAA Omnibus Final Rule, recent enforcement activity, and statements from HHS, we expect increased federal and state HIPAA privacy and security enforcement efforts.

HIPAA also required HHS to adopt national standards for electronic transactions that all healthcare providers must use when submitting or receiving certain healthcare transactions electronically. On January 16, 2009, HHS released the final rule mandating that everyone covered by HIPAA must implement ICD 10 for medical coding on October 1, 2013, which was subsequently extended to October 1, 2015 and is now in effect.

Many states in which we operate and in which our patients reside also have laws that protect the privacy and security of sensitive and personal information, including health information. Moreover, state laws may be similar to or even more protective than HIPAA and other federal privacy laws. For example, the laws of the State of California, in which we operate, are more restrictive than HIPAA. Where state laws are more protective/restrictive than HIPAA, we must comply with the state laws we are subject to, in addition to HIPAA. In certain cases, it may be necessary to modify our existing or planned operations and procedures to comply with these more stringent state laws. Not only may some of these state laws impose fines and penalties upon violators, but, unlike HIPAA, some may afford private rights of action to individuals who believe their personal information has been misused. In addition, state laws could change rapidly, and there is currently a new federal privacy law or federal breach notification law under consideration to which we may be subject.

In addition to HIPAA and state health information privacy laws, we may be subject to other state and federal privacy laws, including laws that prohibit unfair privacy and security acts or practices and deceptive statements about privacy and security and laws that place specific requirements on certain types of activities, such as data security and texting. The FTC and states’ attorneys general have brought enforcement actions and prosecuted some data breach cases as unfair and/or deceptive acts or practices under the FTC Act and similar state laws. Further, the California Consumer Protection Act of 2018 (the “CCPA”), which took effect in 2020 and to which we are subject, imposes obligations and restrictions on businesses regarding their collection, use, and sharing of personal information and provides new and enhanced data privacy rights to California residents, such as affording them the right to access and delete their personal information and to opt out of certain sharing of personal information. Additionally, the California Privacy Rights Act (“CPRA”), which came into effect on January 1, 2023, significantly amends and expands the CCPA, including by providing consumers with additional rights with respect to their personal information. The CPRA also creates a new state agency that will be vested with authority to implement and enforce the CCPA and the CPRA.

Table of Contents

Laws similar to the CCPA and CPRA have passed in Virginia, Colorado, Connecticut, Utah and Washington and are expected in other states and at the federal level, reflecting a trend toward more stringent privacy legislation in the United States.

In recent years, there have been a number of well publicized data breaches involving the improper use and disclosure of personal information and PHI. Many states have responded to these incidents by enacting laws requiring holders of personal information to maintain safeguards and to take certain actions in response to a data breach, such as providing prompt notification of the breach to affected individuals and state officials and providing credit monitoring services and/or other relevant services to impacted individuals. In addition, under HIPAA, breach notification laws and pursuant to the related contracts that we enter into with our clients who are covered entities, we must report breaches of unsecured PHI to our clients following discovery of the breach. Notification must also be made in certain circumstances to affected individuals, federal authorities and others.

Intellectual Property

It is important to our business that we establish, protect and enforce our intellectual property. We rely on a combination of patent, copyright, trademark and trade secret laws as well as confidentiality procedures, contractual provisions and other legal rights to establish and enforce our brand, proprietary technology and other intellectual property rights.

Through March 13, 2024, the Company has been approved for one patent related to “System and Method in Monitoring Engagement” which relates to the tracking of therapeutic progress between therapist and client. We also have one patent that is pending and several other conditional applications in the United States. We intend to continue to apply for additional patents relating to our software and technology. We cannot assure whether any of our patent applications will result in the issuance of a patent or whether the examination process will require us to narrow our claims.

We own and use trademarks and service marks on or in connection with our business and services, including both unregistered marks and registered trademarks in the United States. In addition, we rely on other forms of intellectual property protection including trade secrets, know-how and other unpatented proprietary processes, in each case in support of our business. We make efforts to maintain and protect our intellectual property and the proprietary aspects of our products and technologies, including through the use of nondisclosure agreements and the monitoring of our competitors. Although we take steps to protect our trade secrets and know-how, third parties may independently develop or otherwise gain access to our trade secrets and know-how by lawful means. We require our employees, consultants and certain of our contractors to execute confidentiality agreements in connection with their employment or consulting relationships with us but these agreements may not provide meaningful protection, and we cannot guarantee that we have executed such agreements with all applicable counterparties. Furthermore, these agreements may be breached, and we may not have an adequate remedy for any such breach. We also require our employees and consultants to disclose and assign to us inventions conceived during the term of their employment or engagement while using our property or which relate to our business. We also license certain intellectual property rights that are used in our business from third parties. From time to time, we may become involved in legal proceedings relating to intellectual property arising in the ordinary course of our business, including opposition to our applications for patents, trademarks, challenges to the validity of our intellectual property rights, and claims of intellectual property infringement. We are not presently a party to any such legal proceedings that, in the opinion of our management, would individually or taken together have a material adverse effect on our business, financial condition, results of operations or cash flows.

Additional Information

The Company's principal place of business is at 622 Third Avenue, New York, NY 10017 and its telephone number is (212) 284-7206. The Company's website address is talkspace.com. The Company makes available free of charge on the investors section of its website the Annual Reports on Form 10-K, Quarterly Reports on Form 10-Q, Current Reports on Form 8-K, Proxy Statements and other SEC filings and all amendments to those reports filed or furnished to the SEC pursuant to Section 13(a), 14 or 15(d) of the Exchange Act, as soon as reasonably practicable after we file or furnish such materials to the SEC. The SEC also maintains a website (www.sec.gov) that contains these reports, proxy and information statements and other information. The information on our website is not, and will not be deemed to be, a part of this Annual Report on Form 10-K or incorporated into any of our other filings with the SEC, except where we expressly incorporated such information.

Table of Contents

Item 1A. RISK FACTORS

In the course of conducting our business operations, we are exposed to a variety of risks. Any of the risk factors we describe below have affected or could materially adversely affect our business, financial condition and results of operations. Certain statements in “Risk Factors” are forward-looking statements, see “Forward-Looking Statements” in Part II Item 7.

Unless the context otherwise requires, all references in this subsection as to “Talkspace,” the “Company,” “we,” “us” or “our” refer to the business of Talkspace, Inc. and its consolidated subsidiaries.

SUMMARY RISK FACTORS

The following is a summary of the material risks known to us. Please carefully consider the following risk factors together with all other information included in this Form 10-K and our other publicly filed documents when investing in our common stock.

Risks Related to our Operating Results and Early Stage of Growth

•

We have a history of losses and we may never achieve or sustain profitability.

•

Our business and the markets we operate in are rapidly evolving which makes it difficult to evaluate our future prospects and the risks and challenges we may encounter.

•

We may not grow at the rates we historically have achieved or at all, even if our key metrics may indicate growth, which could have a material adverse effect on the market price of our common stock.

•

We may experience difficulties in managing our growth and expanding our operations.

Risks Related to our Business and Industry

•

Rapid technological change in our industry presents us with significant risks and challenges.

•

We operate in a competitive industry, and if we are not able to compete effectively, our business, financial condition and results of operations will be harmed.

•

If we are unable to secure clients' contract renewals, our business, financial condition and results of operations will be harmed.

•

The future growth and profitability of our business will depend in large part upon the effectiveness and efficiency of our marketing efforts, and our ability to develop brand awareness cost-effectively.

•

We may be unsuccessful in achieving broad market education and changing consumer purchasing habits.

•

Our growth depends in part on the success of our strategic relationships with third parties that we provide services to.

•

Our virtual behavioral healthcare strategies depend on our ability to maintain and expand our network of therapists, psychiatrists and other providers. If we are unable to do so, our future growth would be limited and our business, financial condition and results of operations would be harmed.

•

Developments affecting spending by the healthcare industry could adversely affect our business.

•

Negative media coverage and social media engagement could adversely affect our business.

•

We may become subject to medical liability claims, which could cause us to incur significant expenses and may require us to pay significant damages if not covered by insurance.

•

A decline in the prevalence of enterprise-sponsored healthcare or the emergence of new technologies may adversely impact our DTE business or require us to expend significant resources in order to remain competitive.

•

We rely on third-party platforms such as the Apple Store and the Google Play App Store, to distribute our platform and offerings.

•

We rely on data center providers, Internet infrastructure, bandwidth providers, third-party computer hardware and software, other third parties and our own systems for providing services to our clients and members, and any failure or interruption in the services provided by these third parties or our own systems could expose us to litigation and negatively impact our relationships with clients and members, adversely affecting our bran and our business.

Table of Contents

•

If our or our vendors’ security measures fail or are breached and unauthorized access to a client’s data or information systems is obtained, our services may be perceived as insecure, we may incur significant liabilities, our reputation may be harmed, and we could lose sales, clients and members.

•

There may be adverse tax, legal and other consequences if the employment status of providers on our platform is challenged.

•

Changes in consumer sentiment or laws, rules or regulations regarding the use of cookies, artificial intelligence technologies and other tracking technologies and other privacy matters could have a material adverse effect on our ability to generate net revenues and could adversely affect our ability to collect proprietary data on consumer behavior.

•

Certain U.S. state and local tax authorities may assert that we have a nexus with such states or localities and may seek to impose state and local income taxes on our income allocated to such state and localities and assert we are required to collect sales and use taxes.

•

Our ability to use our net operating losses and certain other attributes may be subject to certain limitations.

•

We depend on our senior management team, and the loss of one or more of our executive officers or key employees or an inability to attract and retain highly skilled and diverse employees could adversely affect our business.

•

We may acquire other companies or technologies, which could divert our management’s attention, result in dilution to our stockholders and otherwise disrupt our operations and we may have difficulty integrating any such acquisitions successfully or realizing the anticipated benefits therefrom, any of which could have a material adverse effect on our business, financial condition and results of operations.

•

Inflation and increased interest rates may increase our operating and capital costs.

Risks Related to our Legal and Regulatory Environment

•

Our business could be adversely affected by legal challenges to our business model or by actions restricting our ability to provide the full range of our services in certain jurisdictions.

•

Evolving government regulations may result in increased costs or adversely affect our results of operations.

•

We are dependent on our relationships with affiliated professional entities, which we do not own, to provide physician and other professional services, and our business, financial condition and our ability to operate in certain jurisdictions would be adversely affected if those relationships were disrupted or if our arrangements with our providers or clients are found to violate state laws prohibiting the corporate practice of medicine or fee splitting.

•

The impact on us of ongoing healthcare legislation and other changes in the healthcare industry and in healthcare spending is currently unknown, but may adversely affect our business, financial condition and results of operations.

•

We conduct business in a heavily regulated industry and if we fail to comply with these laws and government regulations, we could incur penalties or be required to make significant changes to our operations or experience adverse publicity, which could have a material adverse effect on our business, financial condition, and results of operations.

•

Our use and disclosure of personal information, including protected health information ("PHI"), personal data, and other health information, is subject to state, federal or other privacy and security regulations, and our failure to comply with those regulations or to adequately secure the information we hold could result in significant liability or reputational harm and, in turn, a material adverse effect on our client base and member bases and revenue.

•

We may be exposed to compliance obligations and risks under anti-corruption, export controls and economic sanctions laws and regulations of the United States and applicable non-U.S. jurisdictions, and any instances of noncompliance could have a material adverse effect on our reputation and the results of our operations.

Risks Related to our Intellectual Property

•

Any failure to protect, enforce or defend our intellectual property rights could impair our ability to protect our technology and our brand.

•

Third parties may challenge the validity of our trademarks and patents or oppose trademark and patent applications. Companies with other patents could require us to stop using or pay to use required technology.

•

We could incur substantial costs as a result of any claim of infringement of another party’s intellectual property rights.

Table of Contents

•

Our proprietary software may not operate properly, which could damage our reputation, give rise to claims against us or divert application of our resources from other purposes, any of which could harm out business, financial conditions and results of operations.

•

We may enter into collaborations, in-licensing arrangements, joint ventures, strategic alliances or partnerships with third-parties that may not result in the development of commercially viable solutions or the generation of significant future revenues.

Risks Related to Ownership of our Common Stock, our Warrants and Operating as a Public Company

•

We continue to incur costs and devote continued management time as a result of operating as a public company.

•

If we fail to maintain effective internal control over financial reporting in the future, our ability to produce accurate and timely financial statements could be impaired, which may adversely affect investor confidence in us and, as a result, the value of our common stock.

•

Delaware law and our organizational documents contain certain provisions, including anti-takeover provisions that limit the ability of stockholders to take certain actions and could delay or discourage takeover attempts that stockholders may consider favorable.

•

The provision of our certificate of incorporation requiring exclusive forum in certain courts in the State of Delaware or the federal district courts of the United States for certain types of lawsuits may have the effect of discouraging lawsuits against our directors and officers.

•

Future sales and resales of our common stock may cause the market price of our securities to drop significantly, even if our business is doing well.

•

An investor’s percentage of ownership in the Company may be diluted in the future.

•

We do not intend to pay cash dividends for the foreseeable future.

•

You may only be able to exercise your public warrants on a “cashless basis” under certain circumstances, and if you do so, you will receive fewer shares of common stock from such exercise than if you were to exercise such warrants for cash.

•

We may amend the terms of the warrants in a manner that may be adverse to holders of public warrants with the approval by the holders of at least 50% of the then outstanding public warrants. As a result, the exercise price of your warrants could be increased, the exercise period could be shortened and the number of common stock purchasable upon exercise of a warrant could be decreased, all without your approval.

•

The Warrant Agreement designates the courts of the State of New York or the United States District Court for the Southern District of New York as the sole and exclusive forum for certain types of actions and proceedings that may be initiated by holders of our warrants, which could limit the ability of warrant holders to obtain a favorable judicial forum for disputes with us.

•

We may redeem your unexpired warrants prior to their exercise at a time that is disadvantageous to you, thereby making your warrants worthless.

RISKS RELATED TO OUR OPERATING RESULTS AND EARLY STAGE OF GROWTH

We have a history of losses and we may never achieve or sustain profitability.

Though our losses have narrowed in 2023, we have incurred significant losses in each period since our inception. These losses and accumulated deficit reflect the substantial investments we made to acquire new clients and members and to develop our technology platform. To date, we have derived a substantial majority of our revenue from clients and members who pay for access to our virtual behavioral health platform, and our longer-term results of operations and continued growth will depend on our ability to successfully grow our revenue from existing clients and members, to acquire new potential future clients and develop and market new virtual behavioral health products and services that are attractive to our clients and members. We intend to continue scaling our business to increase our client, member and provider bases, broaden the scope of services we offer, invest in research and development and expand the applications of our technology through which clients and members can access our services. Accordingly, we expect to make increased investments to support accelerated growth and the required investment to

Table of Contents

scale our provider network, we also expect increased efficiencies and economies of scale. These efforts may prove more expensive than we currently anticipate, and we may not succeed in increasing our revenue sufficiently to offset these expenses. In addition, our results of operations would also suffer if our innovations are not responsive to the needs of our clients and members, appropriately timed with market opportunity, effectively brought to market or do not achieve market acceptance. We cannot assure you that we will achieve profitability in the future or that, if we do become profitable, we will be able to sustain or increase profitability. As a result of these factors, we may need to raise additional capital through debt or equity financing in order to fund our operations, and such capital may not be available on reasonable terms, if at all.

Our business and the markets we operate in are rapidly evolving, which makes it difficult to evaluate our future prospects and the risks and challenges we may encounter.

Our business and the markets we operate in are rapidly evolving whichmakes it difficult to evaluate and assess the success of our business to date, our future prospects, our business strategy and the risks and challenges that we may encounter. These risks and challenges include our ability to:

●

Retain our existing clients and members that subscribe to our subscription offerings and utilize our services and to attract new clients and members to our platform and subscription offerings and position our platform as a convenient and accepted way to access therapy and psychiatry;

●

convince new and existing clients and members to rapidly adopt new offerings on our platform;

●

attract and retain providers for inclusion in our platform;

●

comply with existing and new laws and regulations applicable to our business and in our industry, as well as additional laws that may be applicable to new service offerings;

●

anticipate and respond to macroeconomic changes, and industry pricing benchmarks and changes in the markets in which we operate;

●

react to challenges from existing and new competitors;

●

maintain and enhance the value of our reputation and brand;

●

maintain and improve the infrastructure underlying our platform, including our apps and websites and with respect to data protection, intellectual property, use of artificial intelligence and cybersecurity; and

●

successfully update our platform, including expanding our platform and offerings into different healthcare products and services, develop and update our software, apps, features, offerings and services to benefit our clients and members and enhance their experience.

If we fail to understand fully or adequately address the challenges that we are currently encountering or that we may encounter in the future, including those challenges described here and elsewhere in this “Risk Factors” section, our business, financial condition and results of operations could be adversely affected. If the risks and uncertainties that we plan for when operating our business are incorrect or change, if we choose the wrong strategic direction, or if we fail to manage these risks successfully, our results of operations could differ materially from our expectations and our business, financial condition and results of operations could be adversely affected.

We may not grow at the rates we historically have achieved or at all, even if our key metrics may indicate growth, which could have a material adverse effect on the market price of our common stock.

We have experienced significant growth in the last several years, and therefore our recent revenue growth rate and financial performance should not be considered indicative of our future performance. From 2021 to 2022 and 2022 to 2023, our revenues grew at a compound annual rate of 5.2% and 25.5%, respectively. In addition, as a result of the COVID-19 pandemic, we experienced a significant increase in revenue, which increases we have managed to maintain for the time being. You should not rely on our revenue or key business metrics for any previous quarterly or annual period as any indication of our revenue, revenue growth, key business metrics, or key business metrics growth in future periods. In particular, our revenue growth rate has fluctuated in prior periods. Our future growth will depend, in part, on our ability to grow our revenue from existing clients and members, to acquire potential future clients and members, especially our Payor and DTE clients, and to expand our client, member and provider bases. We can provide no assurances that we will be successful in executing on these growth strategies or that, even if our key metrics would indicate future growth, we will continue to grow our revenue or to generate net income. Our ability to execute on our existing sales pipeline, create additional sales pipelines, and expand our client and member bases depends on, among other things, the attractiveness of our services relative to those offered by our competitors, our ability to demonstrate the value of our existing and future services, and our ability to attract and retain a sufficient number of qualified sales and

Table of Contents

marketing leadership and support personnel. In addition, our existing clients and members may be slower to adopt our services than we currently anticipate, which could adversely affect our results of operations and growth prospects.

We may experience difficulties in managing our growth and expanding our operations.

We expect to experience significant growth in the scope of our operations. Our ability to manage our operations and future growth will require us to continue to improve our operational, financial and management controls, compliance programs and reporting systems. We may not be able to implement improvements in an efficient or timely manner and may discover deficiencies in existing controls, programs, systems and procedures, which could have an adverse effect on our business, reputation and financial results. If we fail to maintain effective internal control over financial reporting in the future, our ability to produce accurate and timely financial statements could be impaired, which may adversely affect investor confidence in us and, as a result, the value of our common stock. Additionally, rapid growth in our business may place a strain on our human and capital resources as well as our systems and controls.

RISKS RELATED TO OUR BUSINESS AND INDUSTRY

Rapid technological change in our industry presents us with significant risks and challenges.

The virtual behavioral health market is characterized by rapid technological change, changing consumer requirements, short product lifecycles and evolving industry standards. Our success will depend on our ability to enhance our solution with next-generation technologies and to develop or to acquire and market new services to access new client and member populations. There is no guarantee that we will possess the resources, either financial or personnel, for the research, design and development of new applications or services, or that we will be able to utilize these resources successfully and avoid technological or market obsolescence. Further, there can be no assurance that technological advances by one or more of our competitors or future competitors, including advancements in artificial intelligence and machine-learning, will not result in our present or future software-based products and services becoming uncompetitive or obsolete.

We operate in a competitive industry, and if we are not able to compete effectively, our business, financial condition and results of operations will be harmed.

While the virtual behavioral health market is in an early stage of development, it is competitive and we expect it to attract increased competition, which could make it difficult for us to succeed. We currently face competition from a range of companies, including specialized software and solution providers that offer similar solutions and that are continuing to develop additional products and becoming more sophisticated and effective. These competitors include American Well Corporation, Teladoc, Lyra Health and Spring Health, among other small industry participants.

In addition, large, well-financed health systems and health plans have in some cases developed their own telehealth and teletherapy tools and may provide these solutions to their consumers at discounted prices. Competition may also increase from large technology companies, such as Apple, Amazon, Meta, Google, Verizon, or Microsoft, who may wish to develop their own virtual behavioral health solutions, as well as from large retailers like Amazon or Walmart. Competition from large software companies or other specialized solution providers, health systems and health plans, communication tools and other parties could result in continued pricing pressures, which is likely to lead to price declines in certain product segments, which could negatively impact our sales, profitability and market share.

Some of our competitors may have greater name recognition, longer operating histories and significantly greater resources than we do. Further, our current or potential competitors may be acquired by third parties with greater available resources. As a result, our competitors may be able to respond more quickly and effectively than we can to new or changing opportunities, technologies, standards or consumer requirements and may have the ability to initiate or withstand substantial price competition. In addition, current and potential competitors have established, and may in the future establish, cooperative relationships with vendors of complementary products, technologies or services to increase the availability of their solutions in the marketplace. Accordingly, new competitors or alliances may emerge that have greater market share, a larger consumer base, more widely adopted proprietary technologies, greater marketing expertise, greater financial resources and larger sales forces than we have, which could put us at a competitive disadvantage.

Table of Contents

We also expect our competitors to continue to improve their technology infrastructure, including with the use of artificial intelligence (“AI”) and machine learning solutions, to interact with clients, members and insurance companies, sell their services, utilize (and even monetize) their data and support and grow their client base. Our ability to innovate our own technology infrastructure and appropriately address user experience will affect our ability to compete.

Many healthcare provider organizations are consolidating to create integrated healthcare delivery systems with greater market power. As provider networks and managed care organizations consolidate, thus decreasing the number of market participants, competition to provide products and services like ours could become more intense, and the importance of establishing and maintaining relationships with key industry participants could increase. These industry participants may try to use their market power to negotiate price reductions for our products and services. In light of these factors, even if our solution is more effective than those of our competitors, current or potential clients and members may accept competitive solutions in lieu of purchasing our solution. If we are unable to successfully compete in the virtual behavioral health market, our business, financial condition and results of operations could be materially adversely affected.

This risk is amplified by the Company deriving a significant portion of its revenues from a limited number of customers. For the years ended December 31, 2022 and 2023, two customers represented 10% or more of the Company’s total revenue. The loss of business from either of the Company’s significant customers, as a result of competition, customer needs, or other factors beyond the Company’s control, could have a material adverse effect on our business, financial condition and results of operations.

If we are unable to secure clients' contract renewals, our business, financial condition and results of operations will be harmed.

We currently generate most of our revenues from our Payor and DTE clients which contracts are one to three years in length. Consumer subscriptions generally have stated initial terms of one-to-six months and members may cancel their subscription at any time and will receive a pro-rata refund for the subscription price. Most of our clients and members have no obligation to renew their subscriptions for our services after the initial term expires. In addition, our clients may negotiate terms less advantageous to us upon renewal, which may reduce our revenue from these clients. Additionally, our future results of operations depend, in part, on our ability to expand our services and offerings, including broadening our continuum of care. If our clients and members fail to renew their contracts, renew their contracts upon less favorable terms or at lower fee levels or fail to purchase new products and services from us, our revenue may decline or our future revenue growth may be constrained.

Additional factors that could affect our ability to sell products and services include, but are not limited to:

●

price, performance and functionality of our solution;

●

availability, price, performance and functionality of competing solutions;

●

our ability to develop and sell complementary products and services;

●

stability, performance and security of our hosting infrastructure and hosting services; and

●

changes in healthcare marketing laws, regulations or trends.

Any of these consequences could lower retention and have a material adverse effect on our business, financial condition and results of operations.

We believe that developing and maintaining widespread awareness of our brand in a cost-effective manner is critical to achieving widespread adoption of our solution and attracting new clients and members. Our brand promotion activities may not generate consumer awareness or increase revenue, and even if they do, any increase in revenue may not offset the expenses we incur in building our brand. If we fail to successfully promote and maintain our brand, or incur substantial expenses in doing so, we may fail to attract or retain clients and members necessary to realize a sufficient return on our brand-building efforts or to achieve the widespread brand awareness that is critical for broad adoption of our brands.

Table of Contents

We may be unsuccessful in achieving broad market education and changing consumer purchasing habits.

Our success and future growth largely depend on our ability to increase consumer awareness of virtual behavioral therapy in general and our platform and offerings, in particular, and on the willingness of current and potential clients and members to utilize our platform to access information and behavioral health services. We believe the vast majority of consumers make purchasing decisions for behavioral health services on the basis of traditional factors, such as insurance coverage. This traditional decision-making process does not always account for restrictive and complex insurance plans, high deductibles, expensive co-pays and other factors, such as discounts or savings available at alternative therapists or practices. To effectively market our platform, we must educate consumers about the various purchase options and the benefits of using Talkspace for behavioral healthcare, including when such services may not be covered by their health insurance benefits. We focus our marketing and education efforts on potential clients, members and other consumers, but also aim to educate and inform healthcare providers and other participants that interact with consumers, including at the point of purchase. However, we cannot assure you that we will be successful in changing consumer purchasing habits or that we will achieve broad market education or awareness among consumers. Even if we are able to raise awareness among consumers, they may be slow in changing their habits and may be hesitant to use our platform for a variety of reasons.

If we fail to achieve broad market education of our platform and/or the options for purchasing healthcare products and services, or if we are unsuccessful in changing consumer purchasing habits, our business, financial condition and results of operations would be adversely affected.

Our growth depends in part on the success of our strategic relationships with third parties that we provide services to.

In order to grow our business, we anticipate that we will continue to depend on our existing and future relationships with third parties, such as third-party payors, including government agencies, as well as our ability to expand our Payor and DTE business with health plan clients and enterprises that we provide services to. Identifying potential clients, and negotiating and documenting relationships with them, requires significant time and resources. Our competitors may be effective in providing incentives to third parties to favor their products or services or to prevent or reduce subscriptions to, or utilization of, our products and services. In addition, acquisitions of our clients by our competitors could result in a decrease in the number of our current and potential clients and members, as our clients may no longer facilitate the adoption of our applications by potential members. If we are unsuccessful in establishing or maintaining our relationships with third parties that we provide services to, our ability to compete in the marketplace or to grow our revenue could be impaired and our results of operations may suffer. Even if we are successful, we cannot assure you that these relationships will result in increased client use of our services or increased revenue.

Our success is dependent upon our continued ability to grow and maintain a network of highly trained and qualified therapists, psychiatrists and other providers, especially since our providers are generally not exclusive to our platform. If we are unable to recruit and retain licensed therapists, psychiatrists and other providers, it would have a material adverse effect on our business and ability to grow and would adversely affect our results of operations.

In any particular market, providers could demand higher payments or take other actions that could result in higher medical costs, less attractive service for our clients or members or difficulty meeting regulatory or accreditation requirements.

The ability to develop and maintain satisfactory relationships with providers also may be negatively impacted by other factors not associated with us, such as state therapist or psychiatrist licensing laws and standard of care requirements, and other pressures on healthcare providers and consolidation activity among hospitals, physician groups and healthcare providers. Our failure to maintain or to secure new cost-effective provider contracts may result in a loss of or inability to grow our client and member bases, higher costs, less attractive services for our clients and members and/or difficulty in meeting regulatory or accreditation requirements, any of which could have a material adverse effect on our business, financial condition and results of operations.

Table of Contents

Developments affecting spending by the healthcare industry could adversely affect our business.

The U.S. healthcare industry has changed significantly in recent years, and we expect that significant changes will continue to occur. General reductions in expenditures by healthcare industry participants could result from, among other things:

●

government regulations or private initiatives that affect the manner in which healthcare providers interact with patients, payors or other healthcare industry participants, including changes in pricing or means of delivery of healthcare products and services;

●

consolidation of healthcare industry participants;

●

federal amendments to, lack of enforcement or development of applicable regulations for, or repeal of The Patient Protection and Affordable Care Act, as amended by the Health Care and Education Reconciliation Act (the “Affordable Care Act” or the “ACA”);

●

reductions in government funding for healthcare; and

●

adverse changes in business or economic conditions affecting healthcare payors or providers or other healthcare industry participants.

Any of these changes in healthcare spending could adversely affect our revenue. Even if general expenditures by industry participants remain the same or increase, developments in the healthcare industry may result in reduced spending in some or all of the specific market segments that we serve now or in the future. We cannot assure you that the demand for our solutions and services will continue to exist at current levels or that we will have adequate technical, financial, and marketing resources to react to changes in the healthcare industry.

Negative media coverage and social media engagement could adversely affect our business.

We receive a substantial amount of media coverage in the United States. Unfavorable publicity regarding, among others, the healthcare industry, litigation or regulatory activity, the actions of the entities included or otherwise involved in our platform, virtual behavioral health services included on our platform or by other industry participants, our data privacy or data security practices, or our platform could materially adversely affect our reputation. In addition, from time to time, news media outlets have provided negative coverage regarding our platform and privacy practices and any such negative media coverage, regardless of the accuracy of such reporting, may have an adverse impact on our business and reputation, as well as have an adverse effect on our ability to attract and retain clients, members, other consumers, or employees, and result in decreased revenue, which would materially adversely affect our business, financial condition and results of operations.

Our clients and members may engage with us online through our social media pages, including, for example, our presence on Facebook, Instagram and Twitter, by providing feedback and public commentary about all aspects of our business. Information concerning us or our platform and offerings, whether accurate or not, may be posted on social media pages at any time and may have a disproportionately adverse impact on our brand, reputation or business. The harm may be immediate without affording us an opportunity for redress or correction and could have a material adverse effect on our business, financial condition, results of operations and prospects.

We may become subject to medical liability claims, which could cause us to incur significant expenses and may require us to pay significant damages if not covered by insurance.

Our overall business entails the risk of medical liability claims. Although TPN and our affiliated professionals carry or will carry insurance covering medical malpractice claims in amounts that we believe are appropriate in light of the risks attendant to the services rendered, successful medical liability claims could result in substantial damage awards that exceed the limits of the insurance coverage. TPN carries or will carry professional liability insurance for itself and each of its healthcare professionals (our providers). Additionally, all of our network providers that contract or will contract with TPN separately carry or will carry professional liability insurance for itself and its healthcare professionals. Professional liability insurance is expensive and insurance premiums may increase significantly in the future, particularly as we expand our services through TPN and our affiliated professionals. As a result, adequate professional liability insurance may not be available to TPN and our affiliated professionals in the future at acceptable costs or at all, which may negatively impact TPN and our affiliated professionals to provide services to our members, and thereby adversely affect our overall business and operations.

Table of Contents

Any claims made against TPN or our affiliated professionals that are not fully covered by insurance could be costly to defend against, result in substantial damage awards, and divert the attention of our management and our affiliated professional entities from our operations, which could have a material adverse effect on our business, financial condition and results of operations. In addition, any claims may adversely affect our business or reputation.

The U.S. healthcare industry is massive, with a number of large market participants with conflicting agendas, and it is subject to significant government regulation and is currently undergoing significant change.

Some experts have predicted that future healthcare reform will encourage enterprise-sponsored health insurance to become significantly less prevalent as enterprise members migrate to obtain their own insurance over the state-sponsored insurance marketplaces. Were this to occur, there is no guarantee that we would be able to compensate for the loss in revenue from enterprises by increasing sales of our solution to health insurance companies or to individuals or government agencies. In such a case, our results of operations would be adversely impacted.

We rely on third-party platforms such as the Apple App Store and Google Play App Store, to distribute our platform and offerings.

Our apps are accessed and operated through third-party platforms or marketplaces, including the Apple App Store and Google Play App Store, which also serve as significant online distribution platforms for our apps. As a result, the expansion and prospects of our business and our apps depend on our continued relationships with these providers and any other emerging platform providers that are widely adopted by consumers. We are subject to the standard terms and conditions that these providers have for application developers, which govern the content, promotion, distribution and operation of apps on their platforms or marketplaces, and which the providers can change unilaterally on short or no notice.

Thus, our business could suffer materially if platform providers change their standard terms and conditions, interpretations or other policies and practices in a way that is detrimental to us or if platform providers determine that we are in violation of their standard terms and conditions and prohibit us from distributing our apps on their platforms. In addition, our business would be harmed if the providers discontinue or limit our access to their platforms or marketplaces; the platforms or marketplaces decline in popularity; the platforms modify their algorithms, communication channels available to developers, respective terms of service or other policies, including fees; the providers adopt changes or updates to their technology that impede integration with other software systems or otherwise require us to modify our technology or update our apps in order to ensure that consumers can continue to access and use our virtual behavioral health services.

We could be adversely impacted if we fail to create compatible versions of our apps in a timely manner, or if we fail to establish a relationship with such alternative providers. Likewise, if our current providers alter their operating platforms, we could be adversely impacted as our offerings may not be compatible with the altered platforms or may require significant and costly modifications in order to become compatible.

In the past, some of these platforms or marketplaces have been unavailable for short periods of time. If this or a similar event were to occur on a short- or long-term basis, or if these platforms or marketplaces otherwise experience issues that impact the ability of consumers to download or access our apps and other information, it could have a material adverse effect on our brand and reputation, as well as our business, financial condition and operating results.

We serve all of our clients and members from third party interconnection and data centers, such as Amazon Web Services. While we control and have access to our servers, we do not control the operation of these facilities. The cloud vendors and the owners of our data center facilities have no obligation to renew their agreements with us on commercially reasonable terms, or at all. If we are unable to renew these agreements on commercially reasonable terms, or if one of our cloud vendors or data center operators is acquired, we may be required to transfer our servers and other infrastructure to a new vendor or a new data center facility, and we may incur significant costs and possible service interruption in connection with doing so. Problems faced by our cloud vendors or third-party data center locations with the telecommunications network providers with whom we or they contract,

Table of Contents

or with the systems by which our telecommunications providers allocate capacity among their clients, including us, could adversely affect the experience of our clients and members. Our third-party data center operators could decide to close their facilities without adequate notice. In addition, any financial difficulties, such as bankruptcy faced by our cloud vendors or third-party data centers operators or any of the service providers with whom we or they contract may have negative effects on our business, the nature and extent of which are difficult to predict.

Additionally, if our cloud or data center vendors are unable to keep up with our growing needs for capacity, this could have an adverse effect on our business. For example, a rapid expansion of our business could affect the service levels at our cloud vendors or data centers or cause such data centers and systems to fail. Any changes in third-party service levels at our data centers or any disruptions or other performance problems with our solution could adversely affect our reputation and may damage our clients and members’ stored files or result in lengthy interruptions in our services. Interruptions in our services may reduce our revenue, cause us to issue refunds to clients and members for prepaid and unused subscriptions, as well as loss of revenue related to service level credits and uptime, subject us to potential liability or adversely affect client retention.

In addition, our ability to deliver our Internet-based services depends on the development and maintenance of the infrastructure of the Internet by third parties. This includes maintenance of a reliable network backbone with the necessary speed, data capacity, bandwidth capacity and security. Our services are designed to operate without interruption in accordance with our service level commitments. However, we have experienced, and expect that we may experience in the future, interruptions and delays in services and availability from time to time. In the event of a catastrophic event with respect to one or more of our systems, we may experience an extended period of system unavailability, which could negatively impact our relationship with clients and members.

We also rely on computer hardware purchased and software licensed from third parties in order to offer our services. These licenses are generally commercially available on varying terms. However, it is possible that this hardware and software may not continue to be available on commercially reasonable terms, or at all. Any loss of the right to use any of this hardware or software could result in delays in the provisioning of our services until equivalent technology is either developed by us, or, if available from third parties, is identified, obtained and integrated.

Our ability to rely on these services of third-party vendors could be impaired as a result of the failure of such providers to comply with applicable laws, regulations and contractual covenants, or as a result of events affecting such providers, such as power loss, telecommunication failures, software or hardware errors, computer viruses, cyber incidents and similar disruptive problems, fire, flood and natural disasters. Any such failure or event could adversely affect our relationships with our clients and members and damage our reputation. This could materially and adversely impact our business, financial condition and operating results.

Our services involve the storage and transmission of our clients’ and members’ proprietary information, sensitive or confidential data, including valuable intellectual property and personal information of employees, clients, members and others, as well as the PHI of our clients and members. We are subject to laws and regulations relating to the collection, use, retention, security and transfer of this information, including to vendors. Because of the extreme sensitivity of the information we store and transmit, the security features of our and our third-party vendors’ computer, network, and communications systems infrastructure are critical to the success of our business. A breach or failure of our or our third-party vendors’ network, hosted service providers or vendor systems could result from a variety of circumstances and events, including third-party action, employee negligence or error, malfeasance, computer viruses, cyber-attacks by malicious actors such as denial-of-service and phishing attacks, failures during the process of upgrading or replacing software and databases, power outages, hardware failures, telecommunication failures, or catastrophic events.

Information security risks have generally increased in recent years because of the proliferation of new technologies, including the increased adoption of AI technologies, and the increased sophistication and activities of perpetrators of cyber-attacks. Malicious actors are increasingly sophisticated and operating large-scale and complex automated attacks, including on companies within the healthcare industry. The techniques, sources and targets of these attacks change and are often not recognized until such attacks are launched or have been in place for some time. In an increasing amount of cases, these malicious actors are or are acting on behalf of state sponsors which further increases the risk of sophistication, capability and funding for the attack. As cyber threats continue to evolve, we may be required to expend additional resources to further enhance our information security measures, develop additional protocols and/or to investigate and remediate any information security vulnerabilities. If our or our

Table of Contents

third-party vendors’ security measures fail or are breached, it could result in unauthorized persons accessing sensitive client or member data (including PHI), a loss of or damage to our data, an inability to access data sources, or process data or provide our services to our clients and members. Such failures or breaches of our or our third-party vendors’ security measures, or our or our third-party vendors’ inability to effectively resolve such failures or breaches in a timely manner, could severely damage our reputation, adversely affect client, member or investor confidence in us, and reduce the demand for our services from existing and potential clients and members. In addition, we could face litigation, damages for contract breach, monetary penalties, or regulatory actions for violation of applicable laws or regulations and incur significant costs for remedial measures to prevent future occurrences and mitigate past violations.

Any potential security breach could result in increased costs associated with liability for stolen assets or information, repairing system damage that may have been caused by such breaches, incentives offered to clients or other business partners in an effort to maintain our business relationships after a breach and implementing measures to prevent future occurrences, including organizational changes, deploying additional personnel and protection technologies, training employees and engaging third-party experts and consultants. Although we maintain insurance covering certain security and privacy damages and claim expenses, we may not carry insurance or maintain coverage sufficient to compensate for all liability and we cannot be certain that our insurance coverage will be adequate for data security liabilities actually incurred, will cover any indemnification claims against us relating to any incident, will continue to be available to us on economically reasonable terms, or at all, or that any insurer will not deny coverage as to any future claim. In any event, insurance coverage would not address the reputational damage that could result from a security incident.

Data privacy is also subject to frequently changing laws, rules and regulations in the various jurisdictions in which we operate. Such initiatives around the country could increase the cost of developing, implementing or securing our servers and require us to allocate more resources to improved technologies, adding to our IT and compliance costs. Our Board of Directors is briefed periodically on cybersecurity and risk management issues and we have implemented a number of processes to avoid cyber threats and to protect privacy. However, the processes we have implemented in connection with such initiatives may be insufficient to prevent or detect improper access to confidential, proprietary or sensitive data, including personal data. In addition, the competition for talent in the data privacy and cybersecurity space is intense, and we may be unable to hire, develop or retain suitable talent capable of adequately detecting, mitigating or remediating these risks. Our failure to adhere to, or successfully implement processes in response to, changing legal or regulatory requirements in this area could result in legal liability or damage to our reputation in the marketplace. No material cybersecurity incidents have occurred during the year ended December 31, 2023.

There may be adverse tax, legal and other consequences if the employment status of providers on our platform is challenged.

There is often uncertainty in the application of worker classification laws, especially in the medical field where individuals are required to hold professional licenses, and, consequently, there is risk that providers could be deemed to be misclassified under applicable law. We and TPN, structure our relationships with the majority of our respective providers in a manner that we believe results in an independent contractor relationship, not an employee relationship. The tests governing whether a service provider is an independent contractor, or an employee are typically highly fact sensitive and vary by governing law. An independent contractor is generally distinguished from an employee by his or her degree of autonomy and independence in providing services. A high degree of autonomy and independence is generally indicative of a contractor relationship, while a high degree of control is generally indicative of an employment relationship. Although we believe that our and TPN’s providers are properly characterized as independent contractors, tax or other regulatory authorities may in the future challenge our characterization of these relationships. An actual or alleged misclassification determination creates potential exposure for us, including but not limited to: monetary exposure arising from or relating to failure to withhold and remit taxes, unpaid wages and wage and hour laws and requirements (such as those pertaining to minimum wage and overtime); claims for employee benefits, social security, Medicare, workers’ compensation and unemployment; claims of discrimination, harassment and retaliation under civil rights laws; claims under laws pertaining to unionizing, collective bargaining and other concerted activity; and other claims, charges, or other proceedings under laws and regulations applicable to employers and employees, including risks relating to allegations of joint employer liability. Such claims could result in monetary damages or other liability, and any adverse determination, including potentially the requirement for us to indemnify a user, could also harm our brand, which could materially and adversely affect our business, prospects, financial condition and results of operations. While these risks are mitigated, in part, by our contractual rights of indemnification against third-party claims, such indemnification agreements could be determined to be unenforceable or costly to enforce and indemnification under such agreements may otherwise prove inadequate. As a result, any determination that our and/or TPN’s providers are employees could have a material adverse effect on our business, financial condition and results of operations.

Table of Contents

Consumers may become increasingly resistant to the collection, use and sharing of information online, including information used to deliver and optimize advertising, and take steps to prevent such collection, use and sharing of information. For example, consumer complaints and/or lawsuits regarding online advertising or the use of cookies or other tracking technologies in general and our practices specifically could adversely impact our business.

Consumers can currently opt out of the placement or use of most cookies for online advertising purposes by either deleting or disabling cookies on their browsers, visiting websites that allow consumers to place an opt-out cookie on their browsers, which instructs participating entities not to use certain data about consumers’ online activity for the delivery of targeted advertising, or by downloading browser plug-ins and other tools that can be set to: identify cookies and other tracking technologies used on websites; prevent websites from placing third-party cookies and other tracking technologies on the consumer’s browser; or block the delivery of online advertisements on apps and websites.

We are subject to evolving EU and UK privacy national laws derived from the ePrivacy Directive. The current national laws that implement the ePrivacy Directive are highly likely to be replaced across the EU (but not directly in the UK) by an EU regulation known as the ePrivacy Regulation which will significantly increase fines for non-compliance.

There is a trend of increasing enforcement by regulators of the strict approach in recent guidance and decisions which could lead to substantial costs, require significant systems changes, limit the effectiveness of our marketing activities, divert the attention of our technology personnel, adversely affect our margins, increase costs and subject us to additional liabilities. Regulation of cookies and similar technologies, and any decline of cookies or similar online tracking technologies as a means to identify and potentially target users, may lead to broader restrictions and impairments on our marketing and personalization activities and may negatively impact our efforts to understand users.

In response to marketplace concerns about the usage of third-party cookies and web beacons to track user behaviors, providers of major browsers have included features that allow users to limit the collection of certain data generally or from specified websites. In addition, various software tools and applications have been developed that can block advertisements from a consumer’s screen or allow consumers to shift the location in which advertising appears on webpages or opt out of display, search and internet-based advertising entirely. These developments, among others, could impair our ability to collect user information, including personal data and usage information, that helps us provide more targeted advertising to our current and prospective consumers, which could adversely affect our business, given our use of cookies and similar technologies to target our marketing and personalize the consumer experience.

If consumer sentiment regarding privacy issues or the development and deployment of new browser solutions or other Do Not Track mechanisms result in a material increase in the number of consumers who choose to opt out or block cookies and other tracking technologies or who are otherwise using browsers where they need to, and fail to, allow the browser to accept cookies, or otherwise result in cookies or other tracking technologies not functioning properly, our ability to advertise effectively and conduct our business will be impaired, and our results of operations and financial condition would be adversely affected.

There is a risk that certain state tax authorities where we do not currently file a state income tax return could assert that we are liable for state and local income taxes based upon income or gross receipts allocable to such states or localities. States and localities are becoming increasingly aggressive in asserting nexus for state and local income tax purposes. We could be subject to additional state and local income taxation, including penalties and interest attributable to prior periods, if a state or local tax authority in a state or locality where we do not currently file an income tax return successfully asserts that our activities give rise to nexus for state income tax purposes. Such tax assessments, penalties and interest may adversely affect our cash, tax liabilities, results of operations and financial condition.

In addition, state taxing authorities may assert that we had economic nexus with their state and were required to collect sales and use or similar taxes with respect to past or future services that we have provided or will provide, which could result in tax assessments and penalties and interest.

Table of Contents

Our ability to use our net operating losses and certain other attributes may be subject to certain limitations.

The Company has federal and state net operating loss carryovers (“NOL”) which are available to reduce future taxable income. The NOL carry-forwards begin to expire in 2032 and may become subject to annual limitation in the event of certain cumulative changes in the ownership interest of significant stockholders over a three-year period in excess of 50%, as defined under I.R.C. Section 382. This could limit the amount of tax attributes that can be utilized annually to offset future taxable income or future tax liabilities. The federal losses generated from 2018 onward do not expire.

It is possible that we will not generate taxable income in time to use these net operating loss carryforwards before their expiration (or that we will not generate taxable income at all). Under the Tax Cuts and Jobs Act of 2017, U.S. federal net operating losses incurred in 2018 and in future years may be carried forward indefinitely, but the deductibility of such net operating losses is limited. It is uncertain if and to what extent various states will conform to these in federal tax laws. In addition, the federal and state net operating loss carryforwards and certain tax credits may be subject to significant limitations under Section 382 and Section 383 of the Internal Revenue Code, respectively, and similar provisions of state law. Under those sections of the Internal Revenue Code, if a corporation undergoes an “ownership change,” the corporation’s ability to use its pre-change net operating loss carryforwards and other pre-change attributes, such as research tax credits, to offset its post-change income or tax may be limited. In general, an “ownership change” will occur if there is a cumulative change in our ownership by “5-percent shareholders” that exceeds 50 percentage points over a rolling three-year period. Similar rules may apply under state tax laws. We have not undertaken an analysis of whether we have experienced an “ownership change” for purposes of Section 382 and Section 383 of the Internal Revenue Code or whether there are any limitations on use with respect to our net operating losses and other tax attributes.

Our success depends largely upon the continued services of our key members of senior management. These members of senior management are at-will employees and therefore they may terminate their employment with us at any time with no advance notice. We also rely on our leadership team in the areas of research and development, marketing, clinical operations, and general and administrative functions. From time to time, there may be changes in our management team resulting from the hiring or departure of executives, which could disrupt our business. The replacement of one or more of our executive officers or other key employees will likely involve significant time and costs and may significantly delay or prevent the achievement of our business objectives. Our business would also be adversely affected if we fail to adequately plan for succession of our executives and senior management; or if we fail to effectively recruit, integrate, retain and develop key talent and/or align our talent with our business needs, in light of the current rapidly changing environment. While we have employment arrangements with a limited number of key executives, these do not guarantee that the services of these or suitable successor executives will continue to be available to us.

We may not be successful in continuing to attract and retain qualified personnel. We have from time to time in the past experienced, and we expect to continue to experience in the future, difficulty in hiring and retaining highly skilled personnel with appropriate qualifications. The pool of qualified personnel with experience working in the healthcare market is limited overall.

In addition, in making employment decisions, particularly in high-technology industries, job candidates often consider the value of the stock options or other equity instruments they are to receive in connection with their employment. Volatility in the price of our stock may, therefore, adversely affect our ability to attract or retain highly skilled personnel. Failure to attract new personnel or failure to retain and motivate our current personnel, could have a material adverse effect on our business, financial condition and results of operations.

We intend to seek to acquire or invest in businesses, software-based products and services or technologies that we believe could complement or expand our solution, enhance our technical capabilities or otherwise offer growth opportunities. To pursue this strategy successfully, we must identify attractive acquisition or investment opportunities and successfully complete transactions, some of which may be large and complex. We may not be able to identify or complete attractive acquisition or investment opportunities due to, among other things, the intense competition for these transactions. If we are not able to identify and complete

Table of Contents

such acquisition or investment opportunities, our future results of operations and financial condition may be adversely affected. Additionally, the pursuit of potential acquisitions may divert the attention of management and cause us to incur various expenses in identifying, investigating and pursuing suitable acquisitions, whether or not they are consummated.

If we acquire additional businesses, we may not be able to integrate the acquired personnel, operations and technologies successfully, or effectively manage the combined business following the acquisition. We also may not achieve the anticipated benefits from the acquired business as a result of unanticipated costs or liabilities, difficulty converting the clients of the acquired business onto our platform and contract terms, diversion of management’s attention from other business concerns and employee retention issues, among other reasons.

In addition, a significant portion of the purchase price of companies we acquire may be allocated to acquired goodwill and other intangible assets, which generally must be assessed for impairment at least annually. In the future, if our acquisitions do not yield expected returns, we may be required to take charges to our results of operations based on this impairment assessment process, which could adversely affect our results of operations.

Inflation and increased interest rates may increase our operating and capital costs.

In 2023, the global inflation rate began to stabilize and, in some cases decline, as a result of central bank policy tightening; however, core inflation has proved persistent, in addition to the escalating number of significant conflicts throughout the globe. We expect these inflationary pressures to continue to impact our margins and more generally our business in 2024.

After almost 10 years of low interest rate environments, inflationary pressures and efforts in the U.S. and around the world to combat inflation have resulted in increased interest rates by central banks globally. While we do not have any debt outstanding, the increased interest rates could affect our clients’ businesses and borrowing costs, which in turn could impact their ability to make timely payments to us. Given that core inflation has proved persistent, it is uncertain if interest rates will stabilize, continue to increase or decrease.

Our attempts to offset these increasing costs, such as improving efficiency in other areas of the business and passing these increases on to customers, may not be successful. To the extent that our offsetting measures are not sufficient to offset these higher costs, our results of operations may be adversely affected.

RISKS RELATED TO OUR LEGAL AND REGULATORY ENVIRONMENT

Our business could be adversely affected by legal challenges to our business model or by actions restricting our ability to provide the full range of our services in certain jurisdictions.

Our ability to conduct telehealth and teletherapy services through our network of providers in a particular jurisdiction is directly dependent upon the applicable laws governing remote care, the practice of medicine and healthcare delivery in general in such location, which are subject to changing political, regulatory and other influences. With respect to telehealth and teletherapy services, in the past, state medical boards have established new rules or interpreted existing rules in a manner that has limited or restricted our ability to conduct our business as it was conducted in other states. Some of these actions have resulted in the suspension or modification of our telehealth and teletherapy operations in certain states. However, the extent to which a jurisdiction considers particular actions or relationships to comply with the applicable standard of care is subject to change and to evolving interpretations by (in the case of U.S. states) medical boards and state attorneys general, among others, each with broad discretion. Accordingly, we must monitor our compliance with the law in every jurisdiction in which we operate, on an ongoing basis, and we cannot provide assurance that our activities and arrangements, if challenged, will be found to be in compliance with the law.

Additionally, it is possible that the laws and rules governing the practice of medicine, including telehealth and prescribing medication online, in one or more jurisdictions may change in a manner deleterious to our business. For instance, a few states have imposed different, and, in some cases, additional, standards regarding the provision of services via telehealth and teletherapy. Some states impose strict standards on using telehealth and teletherapy to prescribe certain classes of controlled substances that can be commonly used to treat behavioral health disorders. The unpredictability of this regulatory landscape means that sudden changes in policy regarding standards of care and reimbursement are possible. If a successful legal challenge or an adverse change in the relevant laws were to occur, and we or our affiliated medical group were unable to adapt our business model accordingly, our operations in the affected jurisdictions would be disrupted, which could have a material adverse effect on our business, financial condition and results of operations.

Table of Contents

Evolving government regulations may result in increased costs or adversely affect our results of operations.

In a regulatory climate that is uncertain, our operations may be subject to direct and indirect adoption, expansion or reinterpretation of various laws and regulations. Compliance with these future laws and regulations may require us to change our practices at an undeterminable and possibly significant initial monetary and recurring expense. These additional monetary expenditures may increase future overhead, which could have a material adverse effect on our results of operations. We have identified what we believe are the areas of government regulation that, if changed, would be costly to us. These include rules governing the practice of medicine by physicians and other licensed professionals; laws relating to licensure requirements for physicians and other licensed health professionals; laws limiting the corporate practice of medicine and professional fee-splitting; laws governing the issuances of prescriptions in an online setting; cybersecurity and privacy laws; and laws and rules relating to the distinction between independent contractors and employees. There could be laws and regulations applicable to our business that we have not identified or that, if changed, may be costly to us, and we cannot predict all the ways in which implementation of such laws and regulations may affect us.

In the jurisdictions in which we operate, even where we believe we are in compliance with all applicable laws, due to the uncertain regulatory environment, certain jurisdictions may determine that we are in violation of their laws. In the event that we must remedy such violations, we may be required to modify our services and products in a manner that undermines our solution’s attractiveness to our clients, members or providers or experts, we may become subject to fines or other penalties or, if we determine that the requirements to operate in compliance in such jurisdictions are overly burdensome, we may elect to terminate our operations in such places. In each case, our revenue may decline and our business, financial condition and results of operations could be materially adversely affected.

Additionally, the introduction of new services may require us to comply with additional, yet undetermined, laws and regulations. Compliance may require obtaining appropriate licenses or certificates, increasing our security measures and expending additional resources to monitor developments in applicable rules and ensure compliance. The failure to adequately comply with these future laws and regulations may delay or possibly prevent some of our products or services from being offered to members and clients, or their members and patients, which could have a material adverse effect on our business, financial condition and results of operations.

There is increasing pressure for businesses to use AI to streamline processes and remain competitive. It is expected that laws and regulations around the use of AI and machine learning tools will increase over the next few years but it is unknown at this time what these laws and regulations will address and how and whether they will be adopted globally. As we introduce AI or machine learning into our information technology systems, we could become subject to these new regulations, which may be difficult to comply with. Some of our competitors may not be required to comply, which would put us at a competitive disadvantage. In addition, we may find we do not have the right employee set for the advancement of our AI and machine learning initiatives or that we have not provided the appropriate training to our staff.

We have entered into various agreements with Talkspace Provider Network, PA ("TPN"), a Texas professional association entity, which in turn contracts with our other affiliated professional entities ("PC entities"), physicians, therapists, and other licensed professionals for clinical and professional services provided to our members. There is a risk that U.S. state authorities in some jurisdictions may find that these contractual relationships with professional entities, physicians and other healthcare providers providing telehealth and teletherapy violate laws prohibiting the corporate practice of medicine and professional fee splitting. These laws generally prohibit the practice of medicine by lay persons or entities and prohibit us from employing physicians and certain licensed professionals, directing the clinical practice of physicians and certain licensed professionals, holding an ownership interest in an entity that employs physicians and certain licensed professionals or from engaging in certain financial arrangements, such as splitting professional fees with physicians and certain licensed professionals. The laws are intended to prevent unlicensed persons or entities from interfering with or inappropriately influencing a healthcare provider’s professional judgment. The extent to which each state considers particular actions or contractual relationships to constitute improper influence of professional judgment varies across the states and is subject to change and to evolving interpretations by state boards of medicine and professional counselors and therapists, and state attorneys general, among others. As such, we must monitor our compliance with applicable laws in every jurisdiction in which we operate on an ongoing basis and we cannot guarantee that subsequent interpretation of the corporate practice of medicine or fee splitting laws will not circumscribe our business operations.

Table of Contents

TPN contracts with therapists and other licensed professionals or enters into agreements with the PC entities, physicians, therapists and other licensed professionals for the clinical and professional services provided to our members. We do not own TPN or the PC entities; TPN and the PC entities are 100% owned by an independent licensed physician qualified to own TPN and such professional entities in the respective states of incorporation. A material change in our relationship with TPN or among TPN and the contracted professional entities, whether resulting from a dispute among the entities, a change in government regulation, or the loss of these affiliations, could impair our ability to provide services to members as we intend under the transitioned structure and could have a material adverse effect on our business, financial condition, and results of operations.

State corporate practice of medicine doctrines also often impose penalties on physicians themselves for aiding the corporate practice of medicine, which could discourage physicians from participating in our network of providers. Due to the prevalence of the corporate practice of medicine doctrine, including in states where we conduct our business, we are subject to related agreements with TPN. One such agreement is a management services agreement with TPN, pursuant to which TPN reserves exclusive control and responsibility for all aspects of the practice of medicine and the delivery of medical services and we provide non-clinical management and administrative services in exchange for a management fee. The PC entities, physicians, therapists and other licensed professionals who provide clinical and professional services to our members through contracts with TPN also retain exclusive control and responsibility for all aspects of medical services provided to our members. Although we seek to substantially comply with applicable state prohibitions on the corporate practice of medicine and fee splitting, state officials who administer these laws or other third parties may successfully challenge our organization and contractual arrangements with our providers once implemented. If such a claim were successful, we could be subject to civil and criminal penalties and could be required to restructure or terminate the applicable contractual arrangements. A determination that these arrangements violate state statutes, or our inability to successfully restructure our relationships with our providers to comply with these statutes, could eliminate clients located in certain states from the market for our services. Furthermore, these arrangements could subject us to additional scrutiny by federal and state regulatory bodies regarding federal and state fraud and abuse laws. Any scrutiny, investigation, adverse determination or litigation with regard to our arrangements with TPN and the PC entities could have a material adverse effect on our business, financial condition, and results of operations.

The impact on us of healthcare reform legislation and other changes in the healthcare industry and in healthcare spending is currently unknown, but may adversely affect our business, financial condition and results of operations. Our revenue is dependent on the healthcare industry and could be affected by changes in healthcare spending, reimbursement and policy. The healthcare industry is subject to changing political, regulatory and other influences. The ACA made major changes in how healthcare is delivered and reimbursed, and it increased access to health insurance benefits to the uninsured and underinsured population of the United States.

Since its enactment, there have been judicial and Congressional challenges to certain aspects of the ACA. It is uncertain the extent to which any such changes may impact our business or financial condition.

Other legislative changes have been proposed and adopted since the ACA was enacted. These changes include aggregate reductions to Medicare payments to providers of up to 2% per fiscal year pursuant to the Budget Control Act of 2011 and subsequent laws, which began in 2013 and will remain in effect through 2030, with the exception of a temporary suspension from May 1, 2020 through March 31, 2022, unless additional Congressional action is taken. In January 2013, the American Taxpayer Relief Act of 2012 was signed into law, which, among other things, further reduced Medicare payments to several types of providers, including hospitals, imaging centers and cancer treatment centers, and increased the statute of limitations period for the government to recover overpayments to providers from three to five years. New laws may result in additional reductions in Medicare and other healthcare funding, which may materially adversely affect consumer demand and affordability for our products and services and, accordingly, the results of our financial operations. Additional changes that may affect our business include the expansion of new programs such as Medicare payment for performance initiatives for physicians under the Medicare Access and CHIP Reauthorization Act of 2015 (MACRA) which first affected physician payment in 2019. At this time, it is unclear how the introduction of the Medicare quality payment program will impact overall physician reimbursement.

In addition, in 2022, the No Surprises Act went into effect to prevent surprise medical bills to non-federal healthcare program patients. Such changes in the regulatory environment may also result in changes to our payer mix that may affect our operations and revenue. In addition, certain provisions of the ACA authorize voluntary demonstration projects, which include the development of bundling payments for acute, inpatient hospital services, physician services and post-acute services for episodes of hospital care. Further, the ACA may adversely affect payers by increasing medical costs generally, which could have an effect

Table of Contents

on the industry and potentially impact our business and revenue as payers seek to offset these increases by reducing costs in other areas. Certain of these provisions are still being implemented and the full impact of these changes on us cannot be determined at this time.

Uncertainty regarding future amendments to the ACA as well as new legislative proposals to reform healthcare and government insurance programs, along with the trend toward managed healthcare in the United States, could result in reduced demand and prices for our services. We expect that additional state and federal healthcare reform measures will be adopted in the future, any of which could limit the amounts that federal and state governments and other third-party payers will pay for healthcare products and services, which could adversely affect our business, financial condition and results of operations.

Although our services are not currently reimbursed by government healthcare programs such as Medicare or Medicaid, any future reimbursement from federal and/or state healthcare programs could expose our business to broadly applicable fraud and abuse laws and other healthcare laws and regulations that would regulate the business. As we enter the teen mental health market, it will encounter parental consent rules and regulations that vary by state, creating another level of compliance risks. The U.S. healthcare industry is heavily regulated and closely scrutinized by federal and state governments. Comprehensive statutes and regulations govern the manner in which we and our affiliated professional entities may provide and bill for services and collect reimbursement from governmental programs and private payers, our contractual relationships with TPN and its corresponding relationship with its contracted providers, vendors and clients, our marketing activities and other aspects of our operations.

For a summary of the potential applicable U.S. federal and state healthcare laws, see, “Item 1. Business – U.S. Regulation.”

Because of the breadth of these laws and the need to fit certain activities within one of the statutory exceptions and safe harbors available, it is possible that some of our business activities could be subject to challenge under one or more of such laws. Achieving and sustaining compliance with these laws may prove costly. Failure to comply with these laws and other laws can result in civil and criminal penalties such as fines, damages, overpayment recoupment, loss of enrollment status and, if in the future we provide services reimbursable by government healthcare programs, exclusion from the Medicare and Medicaid programs. The risk of our being found in violation of these laws and regulations is increased by the fact that many of them have not been fully interpreted by the regulatory authorities or the courts, and their provisions are sometimes open to a variety of interpretations. Our failure to accurately anticipate the application of these laws and regulations to our business or any other failure to comply with regulatory requirements could create liability for us and negatively affect our business. Any action against us for violation of these laws or regulations, even if we successfully defend against it, could cause us to incur significant legal expenses, divert our management’s attention from the operation of our business and result in adverse publicity.

The laws, regulations and standards governing the provision of healthcare services may change significantly in the future. We cannot assure you that any new or changed healthcare laws, regulations or standards will not materially adversely affect our business. We cannot assure you that a review of our business by judicial, law enforcement, regulatory or accreditation authorities will not result in a determination that could adversely affect our operations.

Failure by us, our employees, affiliates, partners or others with whom we work to comply with applicable laws and regulations could result in administrative, civil, commercial or criminal liabilities, including exclusion from participation in government healthcare programs, including Medicare and Medicaid. Any such penalties could have a material adverse effect on our reputation, our ability to compete for other contracts and our financial position, results of operations and/or cash flows.

Our use and disclosure of personal information, including PHI, personal data, and other health information, is subject to state, federal or other privacy and security regulations, and our failure to comply with those regulations or to adequately secure the information we hold could result in significant liability or reputational harm and, in turn, a material adverse effect on our client base and member bases and revenue.

The privacy and security of personal information stored, maintained, received or transmitted electronically is an enforcement priority in the United States and internationally. While we strive to comply with all applicable privacy and security laws and regulations, as well as our own posted privacy policies and legal standards for privacy, any failure or perceived failure to comply with such requirements may result in proceedings or actions against us by government entities or private parties, or could cause us to lose clients or members, any of which could have a material adverse effect on our business. Recently, there has been an

Table of Contents

increase in public awareness of privacy issues in the wake of revelations about the activities of various government agencies and in the number of private privacy-related lawsuits filed against companies. Any allegations about our practices with regard to the collection, use, disclosure, or security of personal information or other privacy-related matters, even if unfounded and even if we are in compliance with applicable laws, could damage our reputation and harm our business.

In the United States, numerous federal and state laws and regulations govern collection, storage, dissemination, use, retention, transfer, disposal, security and confidentiality of personal information, including HIPAA; U.S. state privacy, security and breach notification and healthcare information laws; the California Consumer Protection Act (“CCPA”); and other data protection laws.

HIPAA requires us to maintain policies and procedures governing PHI that are used or disclosed, and to implement administrative, physical and technical safeguards to protect PHI, including PHI maintained, used and disclosed in electronic form. Ongoing implementation and oversight of these measures involves significant time, effort and expense.

HIPAA also requires that patients be notified of any unauthorized acquisition, access, use or disclosure of their unsecured PHI that compromises the privacy or security of such information, with certain exceptions related to unintentional or inadvertent use or disclosure by employees or authorized individuals. Further, if a breach affects 500 patients or more, it must be reported to the U.S. Department of Health and Human Services Office (“HHS”) without unreasonable delay, and HHS will post the name of the breaching entity on its public web site. Breaches affecting 500 patients or more in the same state or jurisdiction must also be reported to the local media. If a breach involves fewer than 500 people, the covered entity must record it in a log and notify HHS at least annually.

Entities that are found to be in violation of HIPAA as the result of a breach of unsecured PHI or following a complaint about privacy practices or an audit by HHS, may be subject to significant civil, criminal and administrative fines and penalties and/or additional reporting and oversight obligations if required to enter into a resolution agreement and corrective action plan with HHS to settle allegations of HIPAA non-compliance. HIPAA also authorizes state attorneys general to file suit on behalf of their residents and HIPAA's standards have been used as the basis for duty of care in state civil suits such as those for negligence or recklessness in the misuse or breach of PHI. Any such penalties or lawsuits could harm our business, financial condition, results of operations and prospects.

In addition to HIPAA, the U.S. federal government and various states and governmental agencies have adopted or are considering adopting various laws, regulations and standards regarding the collection, use, retention, security, disclosure, transfer and other processing of sensitive and personal information, to which we are or may become subject. For example, California implemented the California Consumer Privacy Act, or CCPA, which came into effect in 2020, and the California Privacy Rights Act (“CPRA”), which came into effect on January 1, 2023, which we are subject. The CCPA imposes obligations and restrictions on businesses regarding their collection, use, processing, retaining and sharing of personal information and provides new and enhanced data privacy rights to California residents. Protected health information that is subject to HIPAA is excluded from the CCPA; however, information we hold about individual residents of California that is not subject to HIPAA would be subject to the CCPA. The CPRA significantly amends and expands the CCPA, including by providing consumers with additional rights with respect to their personal information. The CPRA also creates a new state agency that will be vested with authority to implement and enforce the CCPA and the CPRA. We expect states to continue to enact legislation similar to the CCPA and CPRA that provides consumers with new privacy rights and increases the privacy and security obligations of entities handling certain personal information of such consumers. Laws similar to the CCPA and CPRA have passed in Virginia and Colorado, and have been proposed in other states and at the federal level, reflecting a trend toward more stringent privacy legislation in the United States.

Moreover, we are subject to certain other state laws such as the California Confidentiality of Medical Information Act, which imposes restrictive requirements regulating the use and disclosure of health information and other personal information. Such laws and regulations are not necessarily preempted by HIPAA, particularly if a state affords greater protection to individuals than HIPAA. Where state laws are more protective, we have to comply with the stricter provisions. Further, in addition to fines and penalties imposed upon violators, some of these state laws, such as the CCPA, also afford private rights of action to individuals who believe their personal information has been misused.

TALK US Equity

TALK · 10-K · period ended 2023-12-31

Item 1. BUSINESS

Item 1A. RISK FACTORS

TALK US Equity☆

TALK · 10-K · period ended 2023-12-31

Item 1. BUSINESS

Item 1A. RISK FACTORS

TALK US Equity