Table of Contents

•

unanticipated costs or liabilities, including legal liabilities, associated with the acquisition;



•

difficulties and additional expenses associated with supporting legacy products and hosting infrastructure of the acquired business;



•

difficulty converting the customers of the acquired business into our current and future offerings and contract terms, including disparities in the revenue model of the acquired company;



•

diversion of management's attention or resources from other business concerns;



•

adverse effects on our existing business relationships with customers, members, or strategic partners as a result of the acquisition;



•

the potential loss of key employees; and



•

use of substantial portions of our available cash to consummate the acquisition.

          We may issue equity securities or incur indebtedness to pay for any such acquisition or investment, which could adversely affect our business, results of operations, or financial condition. Any such issuances of additional capital stock may cause stockholders to experience significant

Table of Contents

dilution of their ownership interests and the per share value of our common stock to decline. In addition, a significant portion of the purchase price of any companies we acquire may be allocated to acquired goodwill and other intangible assets, which must be assessed for impairment at least annually. In the future, if our acquisitions do not yield expected returns, we may be required to take charges to our results of operations based on this impairment assessment process, which could adversely affect our results of operations.

           If we do not continue to innovate and provide offerings that are useful to customers and members that achieve and maintain market acceptance, we may not remain competitive, and our revenue and results of operations could suffer.

          Our success depends on our ability to keep pace with technological developments, satisfy increasingly sophisticated customer and member requirements, and achieve and maintain market acceptance on our existing and future offerings in the rapidly evolving market for healthcare and benefits in the United States. In addition, market acceptance and adoption of our existing and future offerings depends on the acceptance by employers, payors, health plans, and government entities as to the distinct features, cost savings, and other perceived benefits of our existing and future offerings as compared to competitive solutions. Our competitors are constantly developing products and services that may become more efficient or appealing to our customers or members. As a result, we must continue to invest significant resources in research and development in order to enhance our existing offerings and introduce new offerings that customers and members will want, while offering our existing and future offerings at competitive prices. If we are unable to predict customer and member preferences or industry changes, or if we are unable to modify our existing and future offerings on a timely or cost-effective basis, we may lose customers. If we are not successful in demonstrating to existing and potential customers the benefits of our existing and future offerings, or if we are not able to achieve the support of employers, healthcare providers, and insurance carriers for our existing and future offerings, our revenue may decline or we may fail to increase our revenue in line with our forecasts. Our results of operations also would suffer if our innovations are not responsive to the needs of our customers and members, are not timed to match the corresponding market opportunity, or are not effectively brought to market, including as the result of delayed releases or releases that are ineffective or have errors or defects.

Table of Contents

           The growth of our business and future success relies in part on our partnerships and other relationships with third parties and our business could be harmed if we fail to maintain or expand these relationships.

          We selectively form partnerships and engage with a range of third parties, including brokers, agents, benefits consultants, carriers, third-party administrators, trusted suppliers, and co-marketing and co-selling partners to grow our customer base and adoption of our offerings. For example, in March 2019, we partnered with Humana and formed a joint go-to-market strategy, which we launched in two initial geographic markets. In October 2019, concurrent with an equity investment from Humana, we expanded our partnership to add a broader base of solutions targeting self- and fully-insured customer prospects and significantly expand our target geographic markets. We may fail to retain and expand these partnerships and other third-party relationships for various reasons, and any such failure could harm our relationship with our customers, our reputation and brand, our prospects, and our business.

          In order to grow our business, we anticipate that we will continue to depend on our relationships with our partners. As we seek to form additional partnerships and other third-party relationships, it is uncertain whether these efforts will be successful, or that these relationships will result in increased customer or member use of our solutions or increased revenue. In the event that we are unable to effectively utilize, maintain, and expand these partnerships and other third-party

Table of Contents

relationships, our revenue growth could slow. Additionally, our partnerships and other third-party relationships may demand, or demand greater, referral fees or commissions.

           If the estimates and assumptions we use to determine the size of our total addressable market are inaccurate, our future growth rate may be impacted and our business would be harmed.

          Market estimates and growth forecasts are subject to significant uncertainty and are based on assumptions and estimates that may prove to be inaccurate. Even if the market in which we compete meets our size estimates and forecasted growth, our business could fail to grow at similar rates, if at all. The principal assumptions relating to our market opportunity include the number of self- and fully-insured employers in the United States, which is estimated to be approximately 21,500 employers with 500 employees or more. Our market opportunity is also based on the assumption that our existing and future offerings will be more attractive to our customers and potential customers than competing solutions. If these assumptions prove inaccurate, our business, financial condition, and results of operations could be adversely affected. For more information regarding our estimates of market opportunity and the forecasts of market growth included in this prospectus, see the section titled "Market and Industry Data."

           We depend on our senior management team, and the loss of one or more of these employees, or an inability to attract and retain qualified key personnel, could adversely affect our business.

          Our success depends, in part, on the skills, working relationships and continued services of Rajeev Singh (Chief Executive Officer), other senior management team members and other key personnel. We do not currently maintain key-person insurance on the lives of any of our key personnel. From time to time, there may be changes in our senior management team resulting from the hiring or departure of executives, which could disrupt our business. The replacement of one or more of our executive officers or other key employees would likely involve significant time and costs and may significantly delay or prevent the achievement of our business objectives.

          While we have entered into offer letters or employment agreements with certain of our executive officers, all of our employees are "at-will" employees, and their employment can be

Table of Contents

terminated by us or them at any time, for any reason and without notice, subject, in certain cases, to severance payment rights. In order to retain valuable employees, in addition to salary and cash incentives, we may provide equity awards that vest over time or based on performance. The value to employees of equity awards that vest over time or based on performance will be significantly affected by movements in our stock price that are beyond our control and may at any time be insufficient to counteract offers from other organizations. The departure of key personnel could adversely affect the conduct of our business. In such event, we would be required to hire other personnel to manage and operate our business, and there can be no assurance that we would be able to employ a suitable replacement for the departing individual, or that a replacement could be hired on terms that are favorable to us. In addition, volatility or lack of performance in our stock price may affect our ability to attract and retain replacements should key personnel depart. If we are not able to retain any of our key personnel, our business could be harmed.

           If we are not able to maintain and enhance our reputation and brand recognition, our business and results of operations will be harmed.

          We believe that maintaining and enhancing our reputation and brand recognition is critical to our relationships with our existing customers and partners, including our trusted suppliers, and to our ability to attract new customers and partners. The promotion of our brand may require us to make substantial investments and we anticipate that, as our market becomes increasingly competitive, these marketing initiatives may become increasingly difficult and expensive. Brand

Table of Contents

promotion and marketing activities may not be successful or yield increased revenue, and to the extent that these activities yield increased revenue, the increased revenue may not offset the expenses we incur and our results of operations could be harmed. In addition, any factor that diminishes our reputation or that of our management, including failing to meet the expectations of customers, members, and partners, and failure to maintain high-quality support, could harm our reputation and brand and make it substantially more difficult for us to attract new customers and trusted suppliers or form new partnerships. Additionally, the performance of third parties with whom we have a relationship, including our trusted suppliers, may also affect our brand and reputation, particularly if our customers and members do not have a positive experience with our trusted suppliers or other third parties. In addition, our sales process is highly dependent on the reputation of our offerings and business and on positive recommendations from our existing customers. If we do not successfully maintain and enhance our reputation and brand recognition, our business may not grow and we could lose our relationships with existing and prospective customers, which would harm our business.

           Any failure to offer high-quality customer and member support services could adversely affect our relationships with our customers and partners and our operating results.

          Our customers and members depend on our support to assist members with their healthcare and other benefits needs. We may be unable to accurately predict our members' demand for services or respond quickly enough to accommodate short-term increases in customer or member demand for services. Increased customer or member demand for services, without a corresponding increase in productivity or revenue, could increase costs and adversely affect our operating results. Any failure to maintain high-quality support, or a market perception that we do not maintain high-quality support, could adversely affect our reputation, our ability to sell our solutions to existing and prospective customers, our relationships with third parties and our ability to form new partnerships, and our business and operating results.

Table of Contents

           If our existing customers do not continue to renew their contracts with us, renew at lower fee levels, decline to purchase additional offerings from us, or terminate their contracts for convenience, our business could be harmed.

          We expect to derive a significant portion of our revenue from the renewal of existing customers' contracts and sales of additional solutions to existing customers. As part of our growth strategy, for instance, we have recently focused on expanding our solutions among current customers. For example, we recently launched Accolade Boost, which leverages our technology platform's decision influence models to identify member population segments for multichannel messaging to encourage additional engagement and member utilization of benefit programs, and our Trusted Supplier Program, which simplifies a customer's vetting and procurement processes for point solutions (including financial, information security, and clinical audits). Achieving a high customer retention rate and selling additional applications and solutions are critical to our future business, revenue growth, and results of operations. Factors that may affect our retention rate and our ability to sell additional applications and solutions include the following:

•

the price, performance, and functionality of our existing and future offerings;



•

the availability, price, performance, and functionality of competing solutions;



•

our ability to develop and sell complementary applications and solutions;



•

changes in healthcare laws, regulations, or trends; and



•

the business environment of our customers.

          We typically enter into contracts with our customers with a stated initial term of three years and various termination rights, which if invoked may cause such contracts to be terminated before

Table of Contents

the term expires. For example, after a specified period, certain of these contracts are terminable for convenience by our customers after a notice period has passed, including existing contracts with some of our largest customers. Approximately 30%An average of 25% of our customer contracts are up for renewal in any given year.each of fiscal year 2021 through fiscal year 2024. We have experienced gross dollar retention for our employer customers of 100%, 95%, and 95%99% for the fiscal years ended February 28,28(9), 2018, 2019, and 2019,2020, respectively. For additional information on the calculation of gross dollar retention, please see "Management's Discussion and Analysis of Financial Condition and Results of Operations." In connection with the recent COVID-19 pandemic, macroeconomic factors may affect our customers' desire to renew their contracts, or even if they do renew, if they undergo layoffs or reductions in force, then our membership numbers would decrease which would reduce our revenues. Some of our largest customers are airlines, and this industry may be particularly susceptible to the current economic factors if there is not additional government assistance. If any of our contracts with our customers is terminated, we may not be able to recover all fees due under the terminated contract, which may adversely affect our operating results. Should any of our customers terminate their relationship with us after implementation of our solutions has begun, we not only would lose our time, effort, and resources invested in that implementation, but also we would have lost the opportunity to leverage those resources to build a relationship with other customers over that same period of time. Our customers may negotiate terms less advantageous to us upon renewal, which may reduce our revenue from these customers and may decrease our annual revenue. Mergers and acquisitions involving our customers have in the past and may in the future lead to non-renewal or termination of our contracts with those customers or by the acquiring or combining companies. If our customers fail to renew their contracts, renew their contracts upon less favorable terms or at lower fee levels, or fail to purchase new solutions from us, our revenue may decline or our future revenue growth may be constrained.

Table of Contents

           The healthcare industry is rapidly evolving and the market for technology-enabled solutions that empower healthcare consumers is relatively immature and unproven. If we are not successful in promoting the benefits of our existing and future offerings, our growth may be limited.

          The market for our solutions is subject to rapid and significant changes. The market for technology-enabled solutions that empower healthcare consumers is characterized by rapid technological change, new product and service introductions, increasing consumer financial responsibility, consumerism and engagement, and the entrance of non-traditional competitors. In addition, there may be a limited-time opportunity to achieve and maintain a significant share of this market due in part to the rapidly evolving nature of the healthcare and technology industries and the substantial resources available to our existing and potential competitors. The market for technology-enabled solutions that empower healthcare consumers is relatively new and unproven, and it is uncertain whether this market will achieve and sustain high levels of demand and market adoption. In order to remain competitive, we are continually involved in a number of projects to compete with new market entrants by developing new offerings, growing our customer base, and expanding into adjacent markets. For example, the Accolade Boost solution and our Trusted Supplier Program are examples of add-on offerings we have recently deployed to complement our traditional offerings and generate additional value to our customers. These projects carry risks, such as cost overruns, delays in delivery, performance problems, and lack of acceptance by our customers. If we cannot adapt to rapidly evolving industry standards, technology, and increasingly sophisticated customers and their employees, our existing technology could become undesirable, obsolete, or harm our reputation.

          We must continue to invest significant resources in our personnel and technology in a timely and cost-effective manner in order to enhance our existing offerings and introduce new offerings that existing customers and potential new customers will want. If our new or modified offerings are not responsive to the preferences of customers and their employees, emerging industry standards, or regulatory changes, are not appropriately timed with market opportunity, or are not effectively brought to market, we may lose existing customers or be unable to obtain new customers, and our results of operations may suffer.

Table of Contents

          Our success also depends to a substantial extent on the ability of our existing and future offerings to increase member engagement and our ability to demonstrate the value of our existing and future offerings to customers. If our existing customers do not recognize or acknowledge the benefits of our existing and future offerings or our offerings do not increase member engagement, then the market for our solutions might not develop at all, or it might develop more slowly than we expect, either of which could adversely affect our operating results. In addition, we have limited insight into trends that might develop and affect our business, which could lead to errors in our predicting and reacting to relevant business, legal, and regulatory trends and healthcare reform. If any of these events occur, it could harm our business.

           We have identified a material weakness in our internal control over financial reporting and may identify additional material weaknesses in the future or otherwise fail to maintain an effective system of internal controls, which may result in material misstatements of our financial statements or cause us to fail to meet our periodic reporting obligations.

          As a public company, we will be required to maintain internal control over financial reporting and to report any material weaknesses in such internal control. Prior to this offering, we were a private company and have limited accounting and financial reporting personnel and other resources with which to address our internal controls and procedures. In connection with the audit of our financial statements for the fiscal year ended February 28, 2019, we and our independent registered public accounting firm identified a material weakness in our internal control over financial reporting. A material weakness is a deficiency, or a combination of deficiencies, in internal control over financial reporting such that there is a reasonable possibility that a material misstatement of our annual or interim financial statements will not be prevented or detected on a timely basis. We determined that we had a material weakness because we lacked internal controls related to the review and approval of manual journal entries. This material weakness could result in a misstatement of account balances or disclosures that would result in a material misstatement to the annual or interim consolidated financial statements that would not be prevented or detected. To address this material weakness, we plan to hire additional accounting personnel and implement process level and management review controls. While we intend to implement a plan to remediate this material weakness, we cannot predict the success of such plan or the outcome of our assessment of this plan at this time. If our steps are insufficient to successfully remediate the material weakness and otherwise establish and maintain an effective system of internal control over financial reporting, the reliability of our financial reporting, investor confidence in us, and the value of our common stock could be materially and adversely affected. We can give no assurance that this implementation will remediate this deficiency in internal control or that additional material weaknesses in our internal control over financial reporting will not be identified in the future. Our failure to implement and maintain effective internal control over financial reporting could result in errors in our financial statements that could result in a restatement of our financial statements, or cause us to fail to meet our periodic reporting obligations. Effective internal control over financial reporting is necessary for us to provide reliable and timely financial reports and, together with adequate disclosure controls and procedures, are designed to reasonably detect and prevent fraud. Any failure to implement required new or improved controls, or difficulties encountered in their implementation, could cause us to fail to meet our periodic reporting obligations. For as long as we are an "emerging growth company" under the JOBS Act, our independent registered public accounting firm will not be required to attest to the effectiveness of our internal control over financial reporting pursuant to Section 404. We could be an "emerging growth company" for up to five years. An independent assessment of the effectiveness of our internal control over financial reporting could detect problems that our management's assessment might not. Undetected material weaknesses in our internal control over financial reporting could lead to financial statement restatements and require us to incur the expense of remediation.

Table of Contents

           We have been and may in the future become subject to litigation, which could harm our business.

          Our business entails the risk of liability claims against us, and we have been and may in the future become subject to litigation. Claims against us may be asserted by or on behalf of a variety of parties, including our customers, our members, vendors of our customers, government agencies, our current or former employees, or our stockholders. We expect there to be an increase in litigation related to employer practices and healthcare in connection with the COVID-19 pandemic, and our risk may increase especially in light of our new offering, Accolade COVID Response Care. Some of these claims may result in significant defense costs and potentially significant judgments against us, some of which are not, or cannot be, covered by adequate insurance. Although we

Table of Contents

carry professional errors and omissions insurance in amounts that we believe are appropriate in light of the risks attendant to our business, successful claims could result in substantial damage awards that exceed the limits of our insurance coverage. In addition, any determination that we are acting in the capacity of a healthcare provider, or exercising undue influence or control over a healthcare provider, may subject us to claims not covered by our professional errors and omissions insurance coverage, or could result in significant sanctions against us and our clinicians, additional compliance requirements, expense, and liability to us. In addition, professional liability insurance is expensive and insurance premiums may increase significantly in the future, particularly as we expand our solutions. As a result, adequate professional liability insurance may not be available to us or to our partners in the future at acceptable costs or at all. We generally intend to defend ourselves vigorously; however, we cannot be certain of the ultimate outcomes of any claims that may arise in the future. Resolution of some of these types of matters against us may result in our having to pay significant fines, judgments, or settlements, which, if uninsured, or if the fines, judgments, and settlements exceed insured levels, could adversely impact our earnings and cash flows, thereby harming our business and per share trading price of our common stock. For example, fines or assessments could be levied against us under domestic or foreign data privacy laws (such as the Health Insurance Portability and Accountability Act of 1996 (HIPAA), the General Data Protection Regulation (GDPR), or the California Consumer Privacy Act of 2018 (CCPA)) or under authority of privacy enforcing governmental entities (such as the Federal Trade Commission (FTC), or the U.S. Department of Health and Human Services (HHS)) or as a result of private actions, such as class actions based on data breaches or based on private rights of action (such as that contained in the CCPA). Certain litigation or the resolution of certain litigation may affect the availability or cost of some of our insurance coverage, which could adversely impact our results of operations and cash flows, expose us to increased risks that would be uninsured and adversely impact our ability to attract directors and officers. In addition, such litigation could result in increased scrutiny by government authorities having authority over our business, such as the FTC, the HHS, Office for Civil Rights (OCR), and state attorneys general.

           Security breaches, loss of data, and other disruptions could compromise sensitive information related to our business, customers, members, or partners, or prevent us from accessing critical information and expose us to liability, which could adversely affect our business and our reputation.

          In the ordinary course of our business, we collect, store, use, and disclose sensitive data, including protected health information (PHI), and other types of personal data or personally identifiable information (PII). We also process and store, and use additional third parties to process and store, sensitive information including intellectual property and other proprietary business information, including that of our customers and members. We manage and maintain our technology platform and data utilizing a combination of on-site systems, mobile applications, managed data center systems, and cloud-based computing center systems. We are highly dependent on information technology networks, mobile applications, and systems, including the Internet, to securely process, transmit, and store this critical information. This is particularly true as our workforce is currently working remotely in response to the stay-at-home orders related to the COVID-19 pandemic. Security breaches of this infrastructure, including physical or electronic break-ins, computer viruses, attacks by hackers, and

Table of Contents

similar breaches, and employee or contractor error, negligence, or malfeasance, can create system disruptions, shutdowns, or unauthorized disclosure or modifications of confidential information, causing member health information to be accessed or acquired without authorization or to become publicly available. We utilize third-party service providers for important aspects of the collection, storage, and transmission of customer and member information, and other confidential and sensitive information, and therefore rely on third parties to manage functions that have material cybersecurity risks. Our technology platform also

Table of Contents

utilizes artificial intelligence and machine learning technology to provide services, and this technology is susceptible to cybersecurity threats, as PHI, PII, and other confidential and sensitive information may be integrated into the platform. Because of the sensitivity of the PHI, other PII, and other confidential information we and our service providers collect, store, transmit, and otherwise process, the security of our technology platform and other aspects of our solutions, including those provided or facilitated by our third-party service providers, are important to our operations and business strategy.

          We take certain administrative, physical, and technological safeguards to address these risks, such as by requiring outsourcing subcontractors and partners, including trusted suppliers, who handle customer and member information for us to enter into agreements that contractually obligate those subcontractors and partners to comply with applicable privacy laws, such as HIPAA, and otherwise use reasonable efforts to safeguard PHI, other PII, and other sensitive information. For those subcontractors and partners who handle PHI on our behalf, we enter into business associate agreements as required by HIPAA. Measures taken to protect our systems, those of our subcontractors and partners, or the PHI, other PII, or other sensitive data we, our subcontractors, or our partners process or maintain, may not adequately protect us from the risks associated with the collection, storage, and transmission of such information.

          Although we take steps to help protect confidential and other sensitive information from unauthorized access or disclosure, our information technology and infrastructure has been in the past and may be vulnerable in the future to attacks by hackers or viruses, failures, or breaches due to third-party action, employee negligence or error, malfeasance, or other incidents or disruptions. A security incident or privacy violation that we experience (or that occurs at a trusted supplier or customer) that leads to disclosure or unauthorized use or modification of, or that prevents access to or otherwise impacts the confidentiality, security, or integrity of, member information, including PHI or other PII, or other sensitive information we, our subcontractors, or our partners maintain or otherwise process, could harm our reputation, compel us to comply with breach notification laws, cause us to incur significant costs for remediation, fines, penalties, notification to customers, affected individuals, including regulatory authorities and the media, and for measures intended to repair or replace systems or technology and to prevent future occurrences, potential increases in insurance premiums, handling of contractual claims (including breach of contract or breach of confidentiality issues), and require us to verify the accuracy of database contents, resulting in increased costs or loss of revenue. In the event of a security breach, we may also be subject to private causes of action and/or statutory penalties under certain state laws, such as the CCPA, which provides a private right of action for data breaches of certain unencrypted or unredacted personal information and establishes statutory penalties for violations of the law. If we are unable to prevent such security breaches or privacy violations or implement satisfactory remedial measures, or if it is perceived that we have been unable to do so, our operations could be disrupted, we may be unable to provide access to our technology platform, and we could suffer a loss of customers, members, or trusted suppliers or a decrease in the use of our existing and future offerings, and we may suffer loss of reputation, adverse impacts on customer, member, partner, and investor confidence, financial loss, governmental investigations or other actions, regulatory or contractual penalties, and other claims and liability. In addition, health plans, benefits administrators, customers, members, and our trusted suppliers may then refuse to provide data to us, or restrict our ability to use such data, in which event our business could be harmed.

Table of Contents

          In addition, security incidents and other inappropriate access to, or acquisition or processing of, information can be difficult to detect or may occur outside of our network (such as in our supply chain or at our customers or trusted suppliers), and any delay in identifying or responding to such incidents or in providing any notification of such incidents may lead to increased harm. Any such breach or interruption of our systems, or the systems of any of our third-party information

Table of Contents

technology partners, could compromise our networks or data security processes and sensitive information could be inaccessible or could be accessed by unauthorized parties, publicly disclosed, lost, or stolen. Any such interruption in access, improper access, disclosure, or other loss of information could result in legal claims or proceedings, liability under laws and regulations that protect the privacy of member information or other personal information, such as HIPAA, CCPA, or GDPR, and regulatory penalties.

          Unauthorized access, loss, or dissemination could also disrupt our operations, including our ability to perform our services, provide member assistance services, conduct research and development activities, collect, process, and prepare company financial information, provide information about our current and future solutions, and engage in other member and clinician education and outreach efforts. Any such breach could also result in the compromise of our trade secrets and other proprietary information, which could adversely affect our business and competitive position. Additionally, actual, potential, or anticipated attacks may cause us to incur increasing costs, including costs to deploy additional personnel and protection technologies, train employees, and engage third-party experts and consultants. Although we maintain insurance covering certain security and privacy damages and claim expenses, we may not carry insurance or maintain coverage sufficient to compensate for all liability and, in any event, insurance coverage would not address the reputational damage that could result from a security incident.

           If we fail to provide accurate and timely information, or if our Accolade Health Assistants and clinicians, our content, or any other element of our existing and future offerings is associated with faulty administrative or clinical decisions or treatment, we could have liability to customers or members, which could adversely affect our results of operations.

          Our Accolade Health Assistants and clinicians, our member web portal, and our mobile application all use our technology platform to support our members in making healthcare and benefits-related decisions. In addition, our Accolade Health Assistants and clinicians use our technology platform to help guide interactions with members. Our technology platform applies artificial intelligence and machine learning tactics to generate predictive insights about our members, which are then translated into recommended interventions for our Accolade Health Assistants and clinicians and used to enhance our member self-service capabilities. Our services, including personalized recommendations and interventions, center around engagement with our members to provide members with better understanding of their benefits, assist with access to care, and provide options for choosing quality providers and care; we do not provide medical care or establish patient relationships with our members. For example, our Accolade Health Assistants can leverage our technology platform to provide quotes to a member about that member's healthcare benefits, including in-network services, balance billing, or claims quotes. If we fail to provide accurate and timely information regarding these benefits or if the data generated by our technology platform (including the artificial intelligence and machine learning components) are inaccurate, fail, or are subject to security incidents, this could lead to claims against us that could result in substantial costs to us or cause demand for our solutions to decline. If our Accolade Health Assistants, clinicians, or technology platform guide people to care settings and providers resulting in faulty clinical decisions or treatment, then our customers or our members could assert claims against us that could result in substantial costs to us, harm our reputation in the industry, and cause demand for our existing and future offerings to decline. For example, our nurses have access to extensive intelligence on provider quality and cost, which allows them to present various options

Table of Contents

to members when they are selecting a primary care physician or specialist. If the member relies on this provider recommendation, and that provider subsequently makes faulty clinical decisions or treatment recommendations, we could be subject to claims by such member. In addition, if our Accolade Health Assistants or clinicians make recommendations outside of our standard protocol

Table of Contents

that result in faulty clinical decisions or treatments, then our customers or our members could assert claims against us.

          In May 2020, we announced a new offering, Accolade COVID Response Care, to provide a comprehensive solution for current and ongoing needs of our customers as they reopen and rebuild their businesses. We may be subject to increased liability exposure from our customers or their members as we assist our customers in managing our customers' return to workplace programs, including the potential for diagnostic and antibody testing. Accordingly, there is the potential for increased liability exposure to Accolade, including as related to an employer's decision not to permit an employee to return to the workplace based on our service or if one of our customers has an outbreak of COVID-19 despite using our solution to plan their reopening.

          The assertion of such claims and ensuing litigation, regardless of its outcome, could result in substantial cost to us, divert management's attention from operations, damage our reputation, and decrease market acceptance of our existing and future offerings. We maintain general liability and insurance coverage, but this coverage may not continue to be available on acceptable terms, may not be available in sufficient amounts to cover one or more large claims against us, or may not provide coverage if our Accolade Health Assistants or clinicians were to engage in the unlicensed practice of medicine. In addition, the insurer might disclaim coverage as to any future claim. One or more large claims could exceed our available insurance coverage. Adequate professional liability insurance may not be available to our providers or to us in the future at acceptable costs or at all. Any claims made against us that are not fully covered by insurance could be costly to defend against, result in substantial damage awards against us, and divert the attention of our management and our providers from our operations, which may harm our business. In addition, any claims may adversely affect our business or reputation.

          Our technology platform may contain errors or failures that are not detected until after the software is introduced or updates and new versions are released. From time to time, we have discovered defects or errors in our software, and such defects or errors can be expected to appear in the future. Defects and errors that are not timely detected and remedied could expose us to risk of liability to customers and members and cause delays in introduction of new solutions, result in increased costs and diversion of development resources, require design modifications, or decrease market acceptance or customer satisfaction with our solutions. If any of these risks occur, they could harm our business.

           We rely on Internet infrastructure, bandwidth providers, data center providers, other third parties, and our own systems for providing solutions to our customers, and any failure or interruption in the services provided by these third parties or our own systems could expose us to litigation and negatively impact our relationships with customers, adversely affecting our brand and our business.

          Our ability to deliver our solutions is dependent on the development and maintenance of the infrastructure of the Internet and other telecommunications services by third parties. We currently host our technology platform, serve our customers and members, and support our operations primarily using third-party data centers and telecommunications solutions, including cloud infrastructure services such as Amazon Web Services (AWS) and Google Cloud. We also use a third-party call center for off-hours clinical support. We do not have control over the operations of the facilities of our data and call center providers, AWS, or Google Cloud. These facilities are vulnerable to damage or interruption from earthquakes, hurricanes, floods, fires, cyber security attacks, terrorist attacks, power losses, telecommunications failures, and similar events. The occurrence of a natural disaster or an act of terrorism, a decision to close the facilities without adequate notice, or other unanticipated problems could result in lengthy interruptions in our solution. The facilities also could be subject to break-ins, computer viruses, sabotage, intentional

Table of Contents

acts of vandalism, and other misconduct. Any errors, failures, interruptions, or delays experienced in connection with these third-party technologies and information services or our own systems could negatively impact our relationships with customers and adversely affect our business and could expose us to third-party liabilities.

Table of Contents

          For some of these services, we may not maintain redundant systems or facilities. Our technology platform's continuing and uninterrupted performance is critical to our success. Members may become dissatisfied by any system failure that interrupts our ability to provide our solutions to them. We may not be able to easily switch our AWS and Google Cloud operations to another cloud service provider if there are disruptions or interference with our use of AWS or Google Cloud. Sustained or repeated system failures would reduce the attractiveness of our technology platform to customers and members and result in contract terminations, thereby reducing revenue. Moreover, negative publicity arising from these types of disruptions could damage our reputation and may adversely impact use of our existing and future offerings. We may not carry sufficient business interruption insurance to compensate us for losses that may occur as a result of any events that cause interruptions in our service. Neither our third-party data and call center providers nor AWS or Google Cloud have an obligation to renew their agreements with us on commercially reasonable terms, or at all. If we are unable to renew our agreements with these providers on commercially reasonable terms, if our agreements with our providers are prematurely terminated, or if in the future we add additional data or call center providers or cloud service providers, we may experience costs or downtime in connection with the transfer to, or the addition of, new providers. If these providers were to increase the cost of their services, we may have to increase the price of our existing and future offerings, and our business may be harmed.

           The COVID-19 outbreak may significantly disrupt our operations and negatively impact our business, financial condition, and results of operations.

          Our business, financial condition, and results of operations could be materially and adversely affected by the effects of a widespread outbreak of a contagious disease, including the recent outbreak of COVID-19. In March 2020, the World Health Organization declared COVID-19 a global pandemic. This pandemic has led to orders to shelter in place, travel restrictions, and mandated business closures and has adversely affected financial markets globally, leading to an economic downturn and increased market volatility. It has also disrupted the normal operations of many businesses, including ours. We have taken measures in response to the COVID-19 pandemic, including temporarily closing our offices and implementing a work from home policy for our workforce and suspending employee travel and in-person meetings. We may experience increased demand on our Accolade Health Assistants and clinical specialists if our members are impacted by a contagious disease in large numbers. This increased demand could result in our failing to meet certain performance metrics set forth in contracts with our customers. Collectively or alone, these conditions could cause (1) increased absenteeism among our workforce (including resulting from sick time or increased use of Family Medical Leave Act and other leave) that could negatively affect our ability to provide our service despite our deployment of business continuity and disaster recovery plans enabling our workforce to work fully remotely from our offices, and/or (2) our customers or prospective customers decreasing headcount, benefits, or budgets, which could decrease corporate spending on our products and services, resulting in delayed sales cycles, a decrease in new customer acquisition, and/or loss of customers. Any layoffs or reductions in employee headcounts by our employer customers would result in a reduction in our base and variable PMPM fees. See "— If our existing customers do not continue to renew their contracts with us, renew at lower fee levels, decline to purchase additional offerings from us, or terminate their contracts for convenience, our business could be harmed." While these risks may be offset by the value that Accolade can provide to customers and members during a health crisis, the impact on our business is still highly uncertain.

Table of Contents

Natural or man-made disasters, events outside our reasonable control, and other similar events may significantly disrupt our operations and negatively impact our business, financial condition, and results of operations.

          Our offices, third-party data and call centers, or cloud infrastructure services may be harmed or rendered inoperable by natural or man-made disasters, including earthquakes, power outages, fires, floods, nuclear disasters, acts of terrorism or other criminal activities, or other events or business continuity problems outside our reasonable control such as a general and widespread failure of the Internet or telecommunications or outbreaks of public health threats, such as the novel coronavirus, which may render it difficult or impossible for us to operate our business for some period of time. Any disruptions in our operations related to the repair or replacement of our offices, third-party data and call centers, or cloud infrastructure services could negatively impact our business and results of operations and harm our reputation. Insurance may not be sufficient to compensate for losses that may occur. Any such losses or damages could harm our business.

Risks Related to Governmental Regulation

           Changes in the health insurance market, ERISA laws, state insurance laws, or other laws could harm our business.

          The market for private health insurance in the United States is evolving and, as our customers are primarily employers that deploy our offerings to employees and their families, our future financial performance will depend in part on the growth in this market. Changes and developments in the health insurance system in the United States could reduce demand for our existing and future offerings and harm our business. For example, there has been an ongoing national debate relating to the healthcare reimbursement system in the United States. Some members of Congress and presidential candidates have introduced proposals that would create a new single payor national health insurance program for all United States residents; others have proposed more incremental approaches, such as creating a new public health insurance plan option as a supplement to private sources of coverage. In the event that laws, regulations or rules that eliminate or reduce private sources of health insurance or require such benefits to be taxable are adopted, the subsequent impact on the workplace benefits provided by our customers may in turn have an adverse effect on our business and results of operations.

Table of Contents

          In addition, changes in laws or regulations regarding the Employee Retirement Income Security Act of 1974 (ERISA), changes in state insurance laws, or other changes in laws could materially impact the self-insured employer healthcare and benefits markets, or the markets in which our other existing or potential customers procure and provide benefits.

           If we fail to comply with healthcare laws and regulations, we could face substantial penalties and our business could be harmed.

          Our existing and future offerings, as well as our business activities, including our relationships with our commercial partners and customers, are or may be in the future subject to a complex set of regulations and rigorous enforcement, including by the HHS, Office of the Inspector General and Office of Civil Rights, U.S. Food and Drug Administration (FDA), U.S. Department of Justice, and numerous other federal and state governmental authorities. There is also rapidly changing COVID-19 guidance from the Centers for Disease Control and Prevention (CDC), state health organizations, the U.S. Equal Employment Opportunity Commission, the Department of Labor, the Occupational Safety and Health Administration, and others, especially as it relates to our new offering, Accolade COVID Response Care. In addition, our employees, consultants, and commercial partners may engage in misconduct or other improper activities, including non-compliance with regulatory standards and requirements. Certain aspects of our business model may also trigger

Table of Contents

scrutiny under healthcare and related laws. Federal and state healthcare and related laws and regulations that may now or in the future affect our ability to conduct business include:

•

HIPAA, as amended by the Health Information Technology for Economic and Clinical Health Act, and its implementing regulations, which impose certain requirements relating to the privacy, security and transmission of protected health information on certain healthcare providers, health plans and healthcare clearinghouses, and their business associates that access or otherwise process individually identifiable health information on their behalf. HIPAA also created criminal liability for knowingly and willfully falsifying or concealing a material fact or making a materially false statement in connection with the delivery of or payment for healthcare benefits, items or services;



•

state laws governing the privacy and security of personal information, including health information and state breach notification requirements, many of which differ from each other in significant ways with respect to scope, application, and requirements, and which often exceed the standards under HIPAA, thus complicating compliance efforts;



•

foreign laws governing the privacy and security of personal information, such as GDPR;



•

laws that regulate how businesses operate online, including measures relating to privacy and data security and how such information is communicated to customers (a) under the FTC's unfair and deceptive trade practice authority from the FTC Act and (b) from state attorneys general under state consumer protection laws and data privacy laws;



•

state laws governing the corporate practice of medicine and other healthcare professions and related fee-splitting laws;



•

the federal Anti-Kickback Statute, which prohibits, among other things, any person from knowingly and willfully offering, soliciting, receiving or providing remuneration, directly or indirectly, in exchange for or to induce either the referral of an individual for, or the purchase, order or recommendation of, any good or service for which payment may be made under federal healthcare programs, such as the CMSCenters for Medicare and Medicaid Services (CMS) programs, including Medicare and Medicaid;



•

the federal civil false claims and civil monetary penalties laws, including the federal False Claims Act, and civil monetary penalties laws, which prohibits,prohibit, among other things, individuals or entities from knowingly presenting, or causing to be presented, false claims, or knowingly using false statements, to obtain payment from the federal government;

Table of Contents

•

federal criminal laws that prohibit executing a scheme to defraud any healthcare benefit program or making false statements relating to healthcare matters;



•

the federal Physician Payments Sunshine Act, or Open Payments, created under the Patient Protection and Affordable Care Act, as amended by the Health Care and Education Affordability Reconciliation Act, or Affordable Care Act, and its implementing regulations, which requires manufacturers of drugs, medical devices, biologicals and medical supplies for which payment is available under Medicare, Medicaid, or the Children's Health Insurance Program to report annually to CMS information related to payments or other transfers of value made to licensed physicians, as defined by such law, and teaching hospitals, as well as ownership and investment interests held by physicians and their immediate family members; and



•

state law equivalents of each of the above federal laws, such as anti-kickback and false claims laws which may apply to items or services reimbursed by any third-party payor, including commercial insurers.

Table of Contents

          The Affordable Care Act, among other things, amendsamended the intent requirement of the federal Anti-Kickback Statute and criminal healthcare fraud statutes. A person or entity no longer needs to have actual knowledge of this statute or specific intent to violate it. In addition, the Affordable Care Act provides that the government may assert that a claim including items or services resulting from a violation of the federal Anti-Kickback Statute constitutes a false or fraudulent claim for purposes of the federal False Claims Act.

          Because of the breadth of these laws and the narrowness of available statutory and regulatory exemptions, it is possible that some of our activities could be subject to challenge under one or more of such laws. For example, there is a risk that regulatory authorities in some states may find that certain of our contractual relationships with healthcare providers are in violation of state anti-kickback or fee-splitting laws. Any action brought against us for violations of these laws or regulations, even if successfully defended, could cause us to incur significant legal expenses and divert our management's attention from the operation of our business. We may be subject to private "qui tam" actions brought by individual whistleblowers on behalf of the federal or state governments, with potential liability under the federal False Claims Act including mandatory treble damages and significant per-claim penalties.

          Although we have adopted policies and procedures designed to comply with these laws and regulations and conduct internal reviews of our compliance with these laws, our compliance is also subject to governmental review. The growth of our business and sales organization may increase the potential of violating these laws or our internal policies and procedures. The risk of our being found in violation of these or other laws and regulations is further increased by the fact that many have not been fully interpreted by the regulatory authorities or the courts, and their provisions are open to a variety of interpretations. Any action brought against us for violation of these or other laws or regulations, even if we successfully defend against it, could cause us to incur significant legal expenses and divert our management's attention from the operation of our business. If our operations are found to be in violation of any of the federal, state and foreign laws described above or any other current or future fraud and abuse or other healthcare laws and regulations that apply to us, we may be subject to penalties, including significant criminal, civil and administrative penalties, damages and fines, disgorgement, additional reporting requirements and oversight if we become subject to a corporate integrity agreement or similar agreement to resolve allegations of noncompliance with these laws, imprisonment for individuals and exclusion from participation in government programs, such as Medicare and Medicaid, as well as contractual damages and reputational harm. We could also be required to curtail or cease our operations. Any of the foregoing consequences could seriously harm our business and our financial results.

Table of Contents

           Our use, disclosure, and other processing of PII and PHI is subject to HIPAA and other federal, state, and foreign privacy and security regulations, and our failure to comply with those regulations or to adequately secure the information we hold could result in significant liability or reputational harm and, in turn, a material adverse effect on our customer base, member base and revenue.

          Numerous state and federal laws and regulations govern the collection, dissemination, use, privacy, confidentiality, security, availability, integrity, and other processing of PHI and PII. These laws and regulations include HIPAA, which establishes a set of national privacy and security standards for the protection of PHI by health plans, healthcare clearinghouses and certain healthcare providers, referred to as covered entities, and the business associates with whom such covered entities contract for services. We are considered a business associate under HIPAA, and we execute business associate agreements with our customers, subcontractors, and trusted suppliers. HIPAA requires covered entities and business associates, such as us, to develop and

Table of Contents

maintain policies and procedures with respect to PHI that is used or disclosed, including the adoption of administrative, physical and technical safeguards to protect such information.

          Some of our business activities require that we or our partners obtain permissions consistent with HIPAA to provide certain marketing and data aggregation services as well as those activities that require the creation and use of de-identified information. Similarly, our new offering, Accolade COVID Response Care requires us to obtain express authorizations from members, which may result in an increased risk of compliance with such authorizations. We may also require large sets of de-identified information to enable us to continue to develop and enhance our data and analytics platform. If we or our partners are unable to secure these rights, or if there is a future change in law, we may face limitations on the use of PHI and our ability to provide marketing services and use de-identified information, which could harm our business or subject us to potential government actions or penalties. Also, there are ongoing public policy discussions regarding whether the standards for de-identified, anonymous or pseudonomized health information are sufficient, and the risk of re-identification sufficiently small, to adequately protect patient privacy. These discussions may lead to further restrictions on the use of such information or create additional regulatory burdens. There can be no assurance that these initiatives or future initiatives will not adversely affect our ability to access and use data or to develop or market current or future services.

          Additionally, through our third party telehealth partners, we provide COVID-19 testing services to consumers on behalf of certain of our employer customers. Such testing services and the related contract tracing activities related to such testing may be subject to the aforementioned laws, including HIPAA.

          In addition, we could be subject to periodic audits for compliance with the HIPAA Privacy and Security Standards by HHS and our customers. HIPAA also implemented the use of standard transaction code sets and standard identifiers that covered entities must use when submitting or receiving certain electronic healthcare transactions, including activities associated with the billing and collection of healthcare claims. HIPAA imposes mandatory penalties for certain violations. Penalties for violations of HIPAA and its implementing regulations start at $100 per violation and are not to exceed $50,000 per violation, subject to a cap of $1.5 million for violations of the same standard in a single calendar year. However, a single breach incident can result in violations of multiple standards. HIPAA also authorizes state attorneys general to file suit on behalf of their residents. Courts may award damages, costs and attorneys' fees related to violations of HIPAA in such cases. While HIPAA does not create a private right of action allowing individuals to sue us in civil court for violations of HIPAA, its standards have been used as the basis for duty of care in state civil suits such as those for negligence or recklessness in the misuse or breach of PHI.

          In addition to HIPAA, numerous other federal, state, and foreign laws and regulations protect the confidentiality, privacy, availability, integrity, and security of PHI and other types of PII. In the case of our European subsidiary, Accolade may have obligations under GDPR and related EU privacy laws and regulations related to the use, transfer, and protection of employee-related data. These laws and regulations in many cases may be more restrictive than, and may not be preempted by, HIPAA and its implementing rules. These laws and regulations may also require additional compliance obligations relating to the transfer of data between Accolade and its subsidiaries. There is a risk that regulatory authorities may determine that we have not implemented

Table of Contents

our compliance obligations in a timely or appropriate manner. Penalties for noncompliance under GDPR and related EU privacy laws may include significant monetary fines. These laws and regulations are often uncertain, contradictory, and subject to changed or differing interpretations, and we expect new laws, rules and regulations regarding privacy, data protection, and information security to be proposed and enacted in the future.

Table of Contents

          Such new regulations and legislative actions (or changes in interpretation of existing laws or regulations regarding data privacy and security together with applicable industry standards) may increase our costs of doing business. In this regard, we expect that there will continue to be new laws, regulations, and industry standards relating to privacy and data protection in the United States, the EU and other jurisdictions, such as the CCPA which has been characterized as the first "GDPR-like" privacy statute to be enacted in the United States, and we cannot determine how broadly or narrowly regulators will interpret and enforce such new laws, regulations, and standards and the corresponding impact it may have on our business. Although we are modifying our data collection, use and processing practices and policies in an effort to comply with the law, there is a risk that the California Attorney General does not find our practices or policies to be compliant with the CCPA, which would potentially subject us to civil penalties or an inability to use information collected from California consumers. In addition, such laws and regulations could restrict our ability to store and process personal data (in particular, our ability to use certain data for purposes such as risk or fraud avoidance, marketing, or advertising due to the expansive definition of personal information under CCPA), our ability to control our costs by using certain vendors or service providers, or impact our ability to offer certain services in certain jurisdictions. Further, the CCPA requires covered companies to provide new disclosures to California consumers, provide such consumers new ways to opt-out of certain sales of personal information (which may not fall under the CCPA HIPAA exemption), and allow for a new cause of action for data breaches. Additionally, such laws and regulations are often inconsistent and may be subject to amendment or re-interpretation, which may cause us to incur significant costs and expend significant effort to ensure compliance. Given that requirements may be inconsistent and evolving, our response to these requirements may not meet the expectations of our customers or their employees, which could thereby reduce the demand for our services. Finally, some customers may respond to these evolving laws and regulations by asking us to make certain privacy or data-related contractual commitments that we are unable or unwilling to make. This could lead to the loss of current or prospective customers or other business relationships.

          This complex, dynamic legal landscape regarding privacy, data protection, and information security creates significant compliance issues for us and our customers and potentially exposes us to additional expense, adverse publicity and liability. Although we take steps to help protect confidential and other sensitive information from unauthorized access or disclosure, our information technology and infrastructure has been in the past and may be vulnerable in the future to attacks by hackers or viruses, failures, or breaches due to third-party action, employee negligence or error, malfeasance, or other incidents or disruptions. For example, we have been the target of phishing attacks seeking confidential information regarding our employees, which resulted in the disclosure of employee confidential information on one occasion. Furthermore, while we have implemented data privacy and security measures in an effort to comply with applicable laws and regulations relating to privacy and data protection, some PHI and other PII or confidential information is transmitted to us by third parties, who may not implement adequate security and privacy measures, and it is possible that laws, rules and regulations relating to privacy, data protection, or information security may be interpreted and applied in a manner that is inconsistent with our practices or those of third parties who transmit PHI and other PII or confidential information to us. If we or these third parties are found to have violated such laws, rules or regulations, it could result in government-imposed fines, orders requiring that we or these third parties change our or their practices, or criminal charges, which could adversely affect our business.

Table of Contents

          We outsource important aspects of the storage and transmission of customer and member information, and thus, rely on third parties to manage functions that have material cyber-security risks. A breach of privacy or security of such information by a subcontractor may result in an enforcement action against us. We attempt to address these risks by requiring outsourcing subcontractors who handle such information to sign business associate agreements contractually

Table of Contents

requiring those subcontractors to adequately safeguard such information. However, we cannot be assured that these contractual measures and other safeguards will adequately protect us from the risks associated with the storage and transmission of such information on our behalf by our subcontractors.

          Complying with these various laws and regulations could cause us to incur substantial costs or require us to change our business practices, systems and compliance procedures in a manner adverse to our business. We also publish statements to our customers and members that describe how we handle and protect PHI (for example, through our privacy policies connected with our website, mobile applications and other digital tools). If federal or state regulatory authorities, such as the FTC or state attorneys general, or private litigants consider any portion of these statements to be untrue, we may be subject to claims of deceptive practices, which could lead to significant liabilities and consequences, including costs of responding to investigations, defending against litigation, settling claims, and complying with regulatory or court orders. Any of the foregoing consequences could seriously harm our business and our financial results. Furthermore, the costs of compliance with, and other burdens imposed by, the laws, regulations and policies that are applicable to the businesses of our customers may limit the use and adoption of, and reduce the overall demand for, our existing and future offerings. Any of the foregoing consequences could harm our business.

           Our employment and use of nurses, physician medical directors and our other clinicians may subject us to licensing and other regulatory risks.

          Our employment and use of nurses, physician medical directors, and our other clinicians may subject us to state and other licensing and regulatory risks. In addition, our subcontracts with clinicians to provide telehealth services related to COVID-19 testing may also subject us to certain licensing and regulatory risks. For example, there may be restrictions on the ability of our employed and contracted clinicians to provide services to our members residing in states outside of the state or states in which such clinicians are licensed or registered. The services provided by our clinicians may be subject to review by state or other regulatory bodies. In addition, any activities conducted by our clinicians that are in violation of practice rules could subject us to fines or other penalties. For example, while we do not provide medical care or establish patient relationships with our members, our clinicians could be found to be practicing outside the scope of their respective licenses in violation of applicable laws. Further, if one of our clinicians is found to be acting outside the scope of their professional license in violation of the applicable state's practice laws, such activity could result in disciplinary action against the clinician by the applicable licensing agency. The definition of what constitutes the practice of medicine, nursing or other health professions varies by state.

          In addition, there is a risk that we may be found in violation of the prohibition of the corporate practice of a health profession under certain state laws, which may result in the imposition of civil or criminal penalties. Certain states prevent corporations from being licensed as practitioners and prohibit physicians from practicing medicine in partnership with non-physicians, such as business corporations. Activities other than those directly related to the delivery of healthcare may be considered an element of the practice of medicine in certain states. These laws, which vary by state, may also prevent the sharing of professional services income with non-professional or business interests. Any determination that we are acting in the capacity as a healthcare provider, exercising undue influence or control over a healthcare provider or impermissibly sharing fees with a healthcare provider, may result in significant sanctions against us and our clinicians, including civil

Table of Contents

and criminal penalties and fines, additional compliance requirements, expense, and liability to us, and require us to change or terminate some portions of our contractual arrangements or business.

Table of Contents

           Evolving government regulations may require increased costs or adversely affect our results of operations.

          In a regulatory climate that is uncertain, our operations may be subject to direct and indirect adoption, expansion, or reinterpretation of various laws and regulations. Compliance with these future laws and regulations may require us to change our practices at an undeterminable and possibly significant initial monetary and annual expense. These additional monetary expenditures may increase future overhead, which could harm our business. For example, since the Affordable Care Act was enacted, there have been judicial and Congressional challenges to certain aspects of the law, as well as efforts by the Trump administration to repeal or replace certain aspects of Affordable Care Act. Since January 2017, President Trump has signed two Executive Orders and other directives designed to delay the implementation of certain provisions of the Affordable Care Act or otherwise circumvent some of the requirements for health insurance mandated by the Affordable Care Act. Concurrently, Congress has considered legislation that would repeal or repeal and replace all or part of the Affordable Care Act. While Congress has not passed comprehensive repeal legislation, two bills affecting the implementation of certain taxes under the Affordable Care Act have been signed into law. The Tax Cuts and Jobs Act of 2017 (Tax Act), included a provision which repealed, effective January 1, 2019, the tax-based shared responsibility payment imposed by the Affordable Care Act on certain individuals who fail to maintain qualifying health coverage for all or part of a year that is commonly referred to as the "individual mandate."

          The Bipartisan Budget Act of 2018, among other things, amended the Affordable Care Act, effective January 1, 2019, to close the coverage gap in most Medicare drug plans, commonly referred to as the "donut hole." In addition, the 2020 federal spending package permanently eliminates,eliminated, effective January 1, 2020, the "Cadillac" tax on high-cost employer-sponsored health coverage and medical device tax that were mandated by the Affordable Care Act and, effective January 1, 2021, also eliminates the health insurer tax. On December 14, 2018, a Texas U.S. District Court Judge ruled that the Affordable Care Act is unconstitutional in its entirety because the "individual mandate" was repealed by Congress as part of the Tax Act. Additionally, on December 18, 2019, the U.S. Court of Appeals for the 5th Circuit upheld the District Court ruling that that the individual mandate was unconstitutional and remanded the case back to the District Court to determine whether the remaining provisions of the Affordable Care Act are invalid as well. On March 2, 2020, the United States Supreme Court granted the petitions for writs of certiorari to review this case, and has allotted one hour for oral arguments, which are expected to occur in fall 2020. It is unclear how this decision, future decisions, subsequent appeals,such litigation and other efforts to repeal and replace the Affordable Care Act will impact the Affordable Care Act. We continue to evaluate the potential impact of the Affordable Care Act and its possible repeal or replacement on our business.

          There could be laws and regulations applicable to our business that we have not identified or that, if changed, may be costly to us, and we cannot predict all the ways in which implementation of such laws and regulations may affect us. In the states in which we operate, we believe we are in compliance with all applicable material regulations, but, due to the uncertain regulatory environment, certain states may determine that we are in violation of their laws and regulations. In the event that we must remedy such violations, we may be required to modify our existing and future offerings and solutions in such states in a manner that undermines our existing and future offerings' attractiveness to partners, customers or members, we may become subject to fines or other penalties or, if we determine that the requirements to operate in compliance in such states are overly burdensome, we may elect to terminate our operations in such states. In each case, our revenue may decline and our business, financial condition, and results of operations could be adversely affected.

          Additionally, the introduction of new solutions may require us to comply with additional, yet undetermined, laws and regulations. Compliance may require obtaining appropriate state medical

Table of Contents

board licenses or certificates, increasing our security measures and expending additional resources to monitor developments in applicable rules and ensure compliance. The failure to adequately comply with these future laws and regulations may delay or possibly prevent our existing and future offerings from being offered to partners, customers and members, which could harm our business. In addition, it is possible that additional governmental action is taken to address the COVID-19 pandemic. For example, the Coronavirus Aid, Relief and Economic Security Act (CARES Act), which was signed into law in March 2020 and is designed to provide financial support and resources to individuals and businesses affected by the COVID-19 pandemic, suspended the reductions to Medicare payments to providers of 2% per fiscal year from May 1, 2020 through December 31, 2020, and extended the sequester by one year, through 2030. Additionally, on April 18, 2020, CMS announced that qualified health plan issuers under the Affordable Care Act may suspend activities related to the collection and reporting of quality data that would have otherwise been reported between May and June 2020 given the challenges healthcare providers are facing responding to the COVID-19 virus.

           Individuals may claim our outbound engagement techniques, including outbound telephone calls and digital outreach, are not compliant with HIPAA or federal marketing laws.

          Several federal laws are designed to protect consumers from various types and modes of marketing. HIPAA prohibits certain types of marketing to individuals using PHI, except for certain treatment and healthcare operations, including communications made to describe a health-related product or service (or payment for such product or service) that is provided by, or included in, a plan of benefits. Our solutions may be subject to review by HHS or OCR and deemed in violation of HIPAA, which could subject us to fines or other penalties. In addition, the Telephone Consumer Protection Act (TCPA), is a federal statute that protects consumers from unwanted telephone calls and faxes. Since its inception, the TCPA's purview has extended to text messages sent to consumers. We may communicate with and perform outreach to members through multiple modes of communication, including phone, email, and secure messaging. We must ensure that our solutions that leverage telephone and secure messaging comply with TCPA regulations and agency guidance. While we strive to adhere to strict policies and procedures, the Federal Communications Commission (FCC), as the agency that implements and enforces the TCPA, may disagree with our interpretation of the TCPA and subject us to penalties and other consequences for noncompliance. Determination by a court or regulatory agency that our solutions violate the TCPA could subject us to civil penalties, could invalidate all or portions of some of our customer contracts, could require us to change or terminate some portions of our offerings, could require us to refund portions of our fees, and could have an adverse effect on our business. Even an unsuccessful challenge by consumers or regulatory authorities of our activities could result in adverse publicity and could require a costly response from us. Other laws focus on unsolicited email, such as the Controlling the Assault of Non-Solicited Pornography and Marketing Act of 2003, (CAN-SPAM Act), which establishes requirements for the transmission of commercial email messages and specifies penalties for unsolicited commercial email messages that follow a recipient's opt-out request or deceive the receiving consumer.

          In addition, some of our marketing activities require that we obtain permissions consistent with HIPAA and applicable state health information privacy laws. If we are unable to secure such permissions, or if there is a future change in law, we may face limitations on the use of such information, which may harm our business.

Table of Contents

           The U.S. Food and Drug Administration may in the future determine that our technology solutions are subject to the Federal Food, Drug, and Cosmetic Act, and we may face additional costs and risks as a result.

          There is a risk that our existing and future offerings, including the operational/technical component of our business model, such as our decision support software incorporating machine learning, meets the definition of a medical device under the Federal Food, Drug, and Cosmetic Act (FDCA). Medical devices are subject to extensive regulation by the FDA under the FDCA. Under the FDCA, medical devices include any instrument, apparatus, machine, contrivance, or other similar or related articles that is intended for use in the diagnosis of disease or other conditions, or in the cure, mitigation, treatment, or prevention of disease. FDA regulations govern among other things, product development, testing, manufacture, packaging, labeling, storage, clearance or approval, advertising and promotion, sales and distribution, and import and export.

Table of Contents

          Failure to appropriately seek FDA approval or noncompliance with applicable FDA requirements can result in, among other things, public warning letters, fines, injunctions, civil penalties, recall or seizure of products, total or partial suspension of production, failure of the FDA to grant marketing approvals, withdrawal of marketing approvals, a recommendation by the FDA to disallow us from entering into government contracts, and criminal prosecutions. The FDA also has the authority to request repair, replace, or refund of the cost of any device.

           Changes in tax laws or regulations that are applied adversely to us or our customers may have a material adverse effect on our business, cash flow, financial condition, or results of operations.

          The Tax Act enacted many significant changes to the U.S. tax laws. Future guidance from the Internal Revenue Service and other tax authorities with respect to the Tax Act may affect us, and certain aspects of the Tax Act could be repealed or modified in future legislation. In addition, in response to the COVID-19 pandemic, the CARES Act was signed into law in March 2020. The CARES Act modifies certain of the changes made by the Tax Act. Changes in corporate tax rates, the realization of net deferred tax assets relating to our U.S. operations, and the deductibility of expenses under the Tax Act, as amended by the CARES Act, or future tax reform legislation could have a material impact on the value of our deferred tax assets, could result in significant one-time charges in the current or future taxable years, and could increase our future U.S. tax expense. The foregoing items, as well as any other future changes in tax laws, could have a material adverse effect on our business, cash flow, financial condition, or results of operations. In addition, it is uncertain if and to what extent various states will conform to the Tax Act, as amended by the CARES Act, or any newly enacted federal tax legislation.

           Taxing authorities may successfully assert that we should have collected or in the future should collect sales and use, value-added, or similar taxes, and we could be subject to liability with respect to past or future sales, which could adversely affect our results of operations.

          We do not collect sales and use, value-added, and similar taxes in all jurisdictions in which we have sales, based on our understanding that such taxes are not applicable. Sales and use, value-added, and similar tax laws and rates vary greatly by jurisdiction. Certain jurisdictions in which we do not collect such taxes may assert that such taxes are applicable, or jurisdictions in which we collect sales tax may assert that we have under-collected sales tax, either of which could result in tax assessments, penalties, and interest, and we may be required to collect such taxes in the future. Although our customer contracts typically provide that our customers must pay all applicable sales and similar taxes, our customers may be reluctant to pay back-taxes and associated interest and penalties, or we may determine that it would not be commercially feasible to seek reimbursement from such customers, in which event any such tax assessments, penalties, and interest, or future requirements may adversely affect our results of operations.

Table of Contents

           Our ability to use our net operating loss carryforwards and certain other tax attributes may be limited.

          As of February 28, 2019,29, 2020, we had U.S. federal net operating loss carryforwards (NOLs), of $198.9$272.8 million and state NOLs of $189.6$258.9 million. UnusedUnder the Tax Act, as modified by the CARES Act, unused NOLs for the fiscal year ended February 28, 201929, 2020 and prior tax years will carry forward to offset future taxable income, if any, until such unused losses expire. Unused losses generated in taxable years beginning after December 31, 2017, which would be our tax year ending February 28, 2018 and thereafter, pursuant to the Tax Act, will not expire and may be carried forward indefinitely but will only be deductible in the case of NOLs arising in taxable years ending after 2020 to the extent of 80% of current year taxable income in any given year. It is uncertain if and to what extent various states will conform to the Tax Act. As a result, if we earn net taxable income in future years, our NOLs arising in tax years ending February 28, 2018 and earlier may expire prior to being used and our NOLs generated in later tax years beginning after 2020 will be subject to a percentage limitation. In addition, under the CARES Act, corporate taxpayers may carryback net operating losses originating in taxable years beginning after 2017 and before 2021 for up to five years, which was not previously allowed under the Tax Act. Under Sections 382 and 383 of the Code, if a corporation undergoes an "ownership change," the corporation's ability to use its pre-change NOLs and other tax attributes

Table of Contents

and to offset its post-change income and taxes may be limited. In general, an "ownership change" occurs if there is a cumulative change in our ownership by "5% stockholders" that exceed 50 percentage points over a rolling three-year period. Our existing NOLs may be subject to limitations arising from previous ownership changes, and if we undergo an ownership change in connection with or after this offering, our ability to utilize NOLs could be further limited by Section 382 of the Code. Future changes in our stock ownership, some of which are outside of our control, could result in an ownership change under Section 382 of the Code. The existing NOLs of one of our subsidiaries may be subject to limitations arising from ownership changes prior to, or in connection with, their acquisition by us. Furthermore, our ability to utilize NOLs of companies that we may acquire in the future may be subject to limitations. There is also a risk that due to regulatory changes, such as suspensions on the use of NOLs or other unforeseen reasons, our existing NOLs could expire or otherwise be unavailable to reduce future income tax liabilities, including for state tax purposes. For these reasons, we may not be able to utilize some portion of our NOLs, none of which are currently reflected on our balance sheet, even if we attain profitability.

Risks Related to our Intellectual Property

           Failure to protect or enforce our intellectual property rights could harm our business and results of operations.

          Our intellectual property includes our processes, methodologies, algorithms, applications, technology platform, software code, website content, user interfaces, graphics, registered and unregistered copyrights, trademarks, trade dress, databases, domain names, and patents and patent applications. We believe that our intellectual property is an essential asset of our business. If we do not adequately protect our intellectual property, our brand and reputation could be harmed and competitors may be able to use our technologies and erode or negate any competitive advantage we may have, which could harm our business, negatively affect our position in the marketplace, limit our ability to commercialize our technology, and delay or render impossible our achievement of profitability. A failure to protect our intellectual property in a cost-effective and meaningful manner could have a material adverse effect on our ability to compete. We regard the protection of our trade secrets, copyrights, trademarks, trade dress, databases, domain names, and patents as critical to our success.

Table of Contents

          We strive to protect our intellectual property rights by relying on federal, state, and common law rights and other rights provided under foreign laws. These laws are subject to change at any time and could further restrict our ability to protect or enforce our intellectual property rights. In addition, the existing laws of certain foreign countries in which we operate may not protect our intellectual property rights to the same extent as do the laws of the United States.

          We generally enter into confidentiality and invention assignment agreements with our employees and contractors, and confidentiality agreements with other parties, with whom we conduct business in order to limit access to, and disclosure and use of, our proprietary information. However, we may not be successful in executing these agreements with every party who has access to our confidential information or contributes to the development of our intellectual property.

          The agreements that we execute may be breached, and we may not have adequate remedies for any such breach. These contractual arrangements and the other steps we have taken to protect our intellectual property may not prevent the misappropriation of our intellectual property or deter independent development of similar intellectual property by others.

          Obtaining and maintaining effective intellectual property rights is expensive, including the costs of monitoring unauthorized use of our intellectual property and defending our rights. We make business decisions about when to seek patent protection for a particular technology and when to rely upon trade secret protection, and the approach we select may ultimately prove to be inadequate. We strive to protect certain of our intellectual property rights through filing applications

Table of Contents

for trademarks, patents, and domain names in a number of jurisdictions, a process that is expensive and may not be successful in all jurisdictions. However, there is no assurance that any resulting patents or other intellectual property rights will adequately protect our intellectual property, or provide us with any competitive advantages. Moreover, we cannot guarantee that any of our pending patent or trademark applications will issue or be approved. Even where we have intellectual property rights, they may later be found to be unenforceable or have a limited scope of enforceability. In addition, we may not seek to pursue such protection in every jurisdiction. The United States Patent and Trademark Office also requires compliance with a number of procedural, documentary, fee payment, and other similar provisions during the patent application process and after a patent has issued. Noncompliance with such requirements and processes may result in abandonment or lapse of the patent or patent application, resulting in partial or complete loss of patent rights in the relevant jurisdiction. In such an event, our competitors might be able to develop and commercialize substantially similar and competing applications, which would harm our business.

          We believe it is important to maintain, protect and enhance our brands. Accordingly, we pursue the registration of domain names and our trademarks and service marks in the United States. Third parties may challenge our use of our trademarks, oppose our trademark applications, or otherwise impede our efforts to protect our intellectual property in certain jurisdictions. In the event that we are unable to register our trademarks in certain jurisdictions, we could be forced to rebrand our solutions, which would result in loss of brand recognition and could require us to devote resources to advertising and marketing new brands. Our competitors and others could also attempt to capitalize on our brand recognition by using domain names or business names similar to ours. Domain names similar to ours have been registered in the United States and elsewhere. We may be unable to prevent third parties from acquiring or using domain names and other trademarks that infringe on, are similar to, or otherwise decrease the value of, our brands, trademarks, or service marks. We also may incur significant costs in enforcing our trademarks against those who attempt to imitate our brand and other valuable trademarks and service marks.

Table of Contents

          In order to protect our intellectual property rights, we may be required to spend significant resources to monitor and protect these rights. We may not be able to detect infringement or unauthorized use of our intellectual property rights, and defending or enforcing our intellectual property rights, even if successfully detected, prosecuted, enjoined, or remedied, could result in the expenditure of significant financial and managerial resources. Litigation has in the past and may be necessary in the future to enforce our intellectual property rights, protect our proprietary rights, or determine the validity and scope of proprietary rights claimed by others. Any litigation of this nature, regardless of outcome or merit, could result in substantial costs and diversion of management and technical resources, any of which could harm our business. Furthermore, our efforts to enforce our intellectual property rights may be met with defenses, counterclaims, countersuits, and adversarial proceedings such as oppositions, inter partes review, post-grant review, re-examination, or other post-issuance proceedings, that attack the validity and enforceability of our intellectual property rights. An adverse determination of any litigation proceedings could put our patents at risk of being invalidated or interpreted narrowly and could put our related pending patent applications at risk of not issuing. Further, because of the substantial amount of discovery required in connection with intellectual property litigation, there is a risk that some of our confidential or sensitive information could be compromised by disclosure in the event of litigation. In addition, during the course of litigation there could be public announcements of the results of hearings, motions, or other interim proceedings or developments. If securities analysts or investors perceive these results to be negative, it could have a substantial adverse effect on the price of our common stock. If we fail to maintain, protect, and enhance our intellectual property rights, our business may be harmed and the market price of our common stock could decline.

Table of Contents

          Our competitors also may independently develop similar technology that does not infringe on or misappropriate our intellectual property rights. The laws of some foreign countries may not be as protective of intellectual property rights as those in the United States, and mechanisms for enforcement of intellectual property rights may be inadequate. Effective patent, trademark, copyright, and trade secret protection may not be available to us in every country in which our solutions or technology are developed. Further, legal standards relating to the validity, enforceability, and scope of protection of intellectual property rights are uncertain. The laws in the United States and elsewhere change rapidly, and any future changes could adversely affect us and our intellectual property. Our failure to meaningfully protect our intellectual property could result in competitors offering solutions that incorporate our most technologically advanced features, which could seriously reduce demand for existing and future offerings.

           Third parties may initiate legal proceedings alleging that we are infringing or otherwise violating their intellectual property rights, the outcome of which would be uncertain and could harm our business.

          Our success depends in part on our ability to develop and commercialize our offerings and use our proprietary technology without infringing the intellectual property or proprietary rights of third parties. Intellectual property disputes can be costly to defend and may cause our business, operating results, and financial condition to suffer. As the market for healthcare in the United States expands and more patents are issued, the risk increases that there may be patents issued to third parties that relate to our offerings and technology of which we are not aware or that we must challenge to continue our operations as currently contemplated. Whether merited or not, we may face allegations that we, our partners, our licensees, or parties indemnified by us have infringed or otherwise violated the patents, trademarks, copyrights, or other intellectual property rights of third parties. Such claims may be made by competitors seeking to obtain a competitive advantage or by other parties.

Table of Contents

          Additionally, in recent years, individuals and groups have begun purchasing intellectual property assets for the purpose of making claims of infringement and attempting to extract settlements from companies like ours. We may also face allegations that our employees have misappropriated the intellectual property or proprietary rights of their former employers or other third parties. We have in the past initiated, and it may in the future be necessary for us to initiate, litigation to defend ourselves in order to determine the scope, enforceability, and validity of third-party intellectual property or proprietary rights, or to establish our respective rights. Regardless of whether claims that we are infringing patents or other intellectual property rights have merit, such claims can be time-consuming, divert management's attention and financial resources, and can be costly to evaluate and defend. Results of any such litigation are difficult to predict and may require us to stop commercializing or using our solutions or technology, obtain licenses, modify our solutions and technology while we develop non-infringing substitutes, or incur substantial damages, settlement costs, or face a temporary or permanent injunction prohibiting us from marketing or providing the affected solutions. If we require a third-party license, it may not be available on reasonable terms or at all, and we may have to pay substantial royalties, upfront fees, or grant cross-licenses to intellectual property rights for our solutions. We may also have to redesign our solutions so that they do not infringe third-party intellectual property rights, which may not be possible or may require substantial monetary expenditures and time, during which our technology and solutions may not be available for commercialization or use. Even if we have an agreement to indemnify us against such costs, the indemnifying party may be unable to uphold its contractual obligations. If we cannot or do not obtain a third-party license to the infringed technology, license the technology on reasonable terms, or obtain similar technology from another source, our revenue and earnings could be adversely impacted.

Table of Contents

          From time to time, we have been and may be subject to legal proceedings and claims in the ordinary course of business with respect to intellectual property. Some third parties may be able to sustain the costs of complex litigation more effectively than we can because they have substantially greater resources. Even if resolved in our favor, litigation or other legal proceedings relating to intellectual property claims may cause us to incur significant expenses and could distract our technical and management personnel from their normal responsibilities. In addition, there could be public announcements of the results of hearings, motions, or other interim proceedings or developments, and if securities analysts or investors perceive these results to be negative, it could have a material adverse effect on the price of our common stock. Moreover, any uncertainties resulting from the initiation and continuation of any legal proceedings could have a material adverse effect on our ability to raise the funds necessary to continue our operations. Assertions by third parties that we violate their intellectual property rights could therefore harm our business.

           Our use of open source software could adversely affect our ability to offer our solutions and subject us to possible litigation.

          We use open source software in connection with our existing and future offerings. Some of these licenses contain requirements that we make available source code for modifications or derivative works we create based upon the open source software, and that we license such modifications or derivative works under the terms of a particular open source license or other license granting third-parties certain rights of further use. By the terms of certain open source licenses, we could be required to release the source code of our proprietary software and to make our proprietary software available under open source licenses, if we combine and/or distribute our proprietary software with open source software in certain manners. Although we monitor our use of open source software, we cannot be sure that all open source software is reviewed prior to use in our proprietary software, that our programmers have not incorporated open source software into our proprietary software, or that they will not do so in the future. Additionally, the terms of many open source licenses to which we are subject have not been interpreted by U.S. or foreign courts.