Omada Health, Inc. (OMDA) Risk Analysis

The global data protection landscape is rapidly evolving, and there has been an increasing focus on data privacy and protection issues with the potential to affect our business. We, our affiliated professional entities, and our business partners and service providers are, or may become, subject to numerous federal, state, and foreign laws, requirements, and regulations governing the collection, transmission, use, processing, disclosure, storage, retention, security, and other processing of personal information, such as information that we may collect in connection with conducting our business in the U.S. and abroad. Implementation standards and enforcement practices are likely to remain uncertain for the foreseeable future, and we cannot yet determine the impact future laws, regulations, standards, or perception of their requirements may have on our business. This evolution may create uncertainty in our business, affect our ability to operate in certain jurisdictions or to collect, store, transfer, use, and share personal information, necessitate the acceptance of more onerous obligations in our contracts, result in liability, or impose additional costs on us. The cost of compliance with these laws, regulations, and standards, including costs related to organizational changes, modifying our data processing practices and policies, implementing additional protection technologies, training employees, and engaging consultants, is high and is likely to increase in the future. Any failure or perceived failure by us, our affiliated professional entities, or our business partners or service providers to comply with federal, state, or foreign laws or regulations, our internal policies and procedures, or our contracts governing our processing of personal information could result in negative publicity, government investigations and enforcement actions, fines, public censure, claims by third parties, damage to our reputation, loss of goodwill, and loss of customers, channel partners, or members, any of which could have a material adverse effect on our business, financial condition, results of operations, and prospects. In the ordinary course of our business, we and our affiliated professional entities collect and store confidential information, including PHI, personal information, intellectual property, and proprietary business information owned or controlled by ourselves or our customers, channel partners, members, covered individuals, third-party payers, business partners, and other parties. We also collect and store personal and sensitive information of our employees, consultants, and contractors. We manage and maintain our applications and data utilizing cloud-based data centers for personal information. We utilize external security and infrastructure vendors to manage parts of our data centers. As a healthcare provider and, at times, a business associate of our customers and channel partners, we, our affiliated professional entities, and certain of our business partners and service providers must comply with the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"). We also must comply with HIPAA in regard to certain of our self-insured health benefits for our employees and their dependents. HIPAA establishes privacy and security standards that limit the use and disclosure of PHI and imposes privacy, security, and breach notification obligations on certain healthcare providers, health plans, and healthcare clearinghouses, known as covered entities, as well as their business associates that perform certain services that involve creating, receiving, maintaining, or transmitting individually identifiable health information for or on behalf of such covered entities, and their covered subcontractors. We, our affiliated professional entities, and certain of our business partners and service providers must comply with HIPAA requirements, including the implementation of administrative, physical, and technical safeguards to ensure the confidentiality, integrity, and availability of individually identifiable health information. Entities that are found to be in violation of HIPAA as the result of a breach of unsecured PHI, a complaint about privacy practices, or an audit by HHS may be subject to significant civil, criminal, and administrative fines and penalties and/or additional reporting and oversight obligations if required to enter into a resolution agreement and corrective action plan with HHS to settle allegations of HIPAA non-compliance. HIPAA imposes mandatory penalties for certain violations; however, a single breach incident can result in violations of multiple standards, which could result in significant fines. HIPAA also authorizes state attorneys general to file suit on behalf of their residents and enables courts to award damages, costs, and attorneys' fees related to violations of HIPAA in connection with those suits. While HIPAA does not create a private right of action allowing individuals to sue us in civil court for violations of HIPAA, its standards have been used as the basis for duty of care in state civil suits such as those for negligence or recklessness in the misuse or breach of PHI. Any such penalties or lawsuits could harm our business, financial condition, results of operations, prospects, and reputation. HIPAA further requires that individuals be notified in certain instances of unauthorized acquisition, access, use, or disclosure of their unsecured PHI. Covered entities must report breaches of unsecured PHI to affected individuals without unreasonable delay, not to exceed 60 days following discovery of the breach by a covered entity or its agents. Notification also must be made to the HHS Office for Civil Rights and, in certain circumstances involving large breaches, to the media. Business associates must report breaches of unsecured PHI to covered entities within 60 days of discovery of the breach by the business associate or its agents or such shorter period as may be provided for in contractual agreements. A non-permitted use or disclosure of PHI is presumed to be a breach under HIPAA unless the covered entity or business associate establishes that there is a low probability the information has been compromised consistent with requirements enumerated in HIPAA. Any obligations to send such notifications could severely damage our reputation and affect the confidence of our customers, channel partners, and members. Certain states have also adopted comparable privacy and security laws and regulations, some of which may be more stringent than HIPAA. Such laws and regulations will be subject to interpretation by various courts and other governmental authorities, thus creating potentially complex compliance issues for us, our affiliated professional entities, and our future customers, channel partners, and strategic partners. For example, the CCPA requires covered businesses that process the personal information of California residents to, among other things: (i) provide certain disclosures to California residents regarding the business's collection, use, and disclosure of their personal information; (ii) receive and respond to requests from California residents to access, delete, and correct their personal information, or to opt out of certain disclosures of their personal information; and (iii) enter into specific contractual provisions with service providers that process California resident personal information on the business's behalf. Additional compliance investment and potential business process changes may be required. Similar laws have been enacted in other states and are continuing to be proposed at the state and federal level, including a new proposed comprehensive federal data protection law to which we would become subject to, reflecting a trend toward more stringent privacy legislation in the U.S. The enactment of such laws may have potentially conflicting requirements that would make compliance challenging. Furthermore, the U.S. Federal Trade Commission ("FTC") and many state attorneys general continue to enforce federal and state consumer protection laws against companies that mislead customers about HIPAA compliance, make deceptive statements about privacy and data sharing in privacy policies, fail to limit third-party use of PHI and certain other personal information, fail to implement policies to protect PHI and certain other personal information, and use online collection, use, dissemination, and security practices that appear to be unfair or deceptive. For example, according to the FTC, failing to take appropriate steps to keep consumers' personal information secure can constitute unfair acts or practices in or affecting commerce in violation of Section 5(a) of the Federal Trade Commission Act. The FTC expects a company's data security measures to be reasonable and appropriate in light of the sensitivity and volume of consumer information it holds, the size and complexity of its business and the cost of available tools to improve security and reduce vulnerabilities. Additionally, federal and state consumer protection laws are increasingly being applied by FTC and state attorneys general to regulate the collection, use, storage, and disclosure of personal information, through websites or otherwise, and to regulate the presentation of website content. There are also a number of legislative proposals in the U.S., at both the federal and state level, that could impose new obligations in areas such as e-commerce and other related legislation or liability for copyright infringement by third parties. We cannot yet determine the impact that these future laws, regulations, and standards may have on our business. Additionally, we send short message services ("SMS") text messages to members and potential members. Federal or state regulatory authorities or private litigants may claim that the notices and disclosure we provide, form of consent we obtain, or our SMS texting practices are not adequate or violate applicable law. In addition, we must ensure that our SMS texting practices comply with regulations and agency guidance under the Telephone Consumer Protection Act (the "TCPA"), a federal statute that protects consumers from unwanted telephone calls, faxes, and text messages. While we strive to adhere to strict policies and procedures that comply with the TCPA, the Federal Communications Commission ("FCC"), as the agency that implements and enforces the TCPA, may disagree with our interpretation of the TCPA and subject us to penalties and other consequences for noncompliance. Determination by a court or regulatory agency that our SMS texting practices violate the TCPA could subject us to civil penalties and could require us to change some portions of our business. Even an unsuccessful challenge by members or regulatory authorities of our activities could result in adverse publicity and could require a costly response from and defense by us. Moreover, if wireless carriers or their trade associations, which issue guidelines for texting programs, determine that have violated their guidelines, our ability to engage in texting programs may be curtailed or revoked, which could impact our operations and cause us to incur costs related to implementing a workaround solution. Although we, our affiliated professional entities, and our business partners and service providers work to comply with applicable laws, regulations and standards, our contractual obligations, and other legal obligations, these requirements are evolving and may be modified, interpreted, and applied in an inconsistent manner from one jurisdiction to another, and may conflict with one another or other legal obligations with which we must comply. Any failure or perceived failure by us, our affiliated professional entities, or our employees, representatives, contractors, consultants, business partners, service providers, or other third parties to comply with such requirements or adequately address privacy and security concerns, even if unfounded, could result in additional cost and liability to us, damage to our reputation, negative publicity, members curtailing their use of, or ceasing to use, our programs and/or the loss of customers, channel partners, or covered individuals, loss of goodwill, significant costs for remediation, notification to individuals, and for measures to prevent future non-compliance, each which may materially and adversely affect our business, financial condition, results of operations, and prospects. Any losses, costs, or liabilities may not be covered by, or may exceed the coverage limits of, applicable insurance policies.

The markets in which we operate are characterized by rapid technological change, frequent new product and service introductions and enhancements, changing demands from customers and channel partners, updates to clinical guidelines and best practices, and evolving industry standards. The introduction of new drugs, changes in clinical guidelines or healthcare benefits, or the evolution of products and services embodying new technologies can quickly make existing products and services obsolete and unmarketable. In particular, the rapid pace of innovation in AI and machine learning can lead to the development of new, improved, or more cost-effective solutions that could render our programs and offerings less competitive or obsolete. Additionally, changes in laws and regulations could impact the usefulness of our programs and could necessitate changes or modifications to our programs to accommodate such changes. We invest substantial resources in researching and developing new programs and enhancing our programs and platform by incorporating additional features, improving functionality, and adding other improvements to meet market demands and our members' evolving needs. The success of any enhancements or improvements to our platform, programs, or any new programs depends on several factors, including timely completion, competitive pricing, adequate quality testing, integration with new and existing technologies in our programs platform and third-party partners' technologies, clinical results, cost effectiveness, and overall market acceptance. Our development of programs also depends on rights or interests in certain intellectual property, which we or third parties on which we rely may own or license. We may not succeed in developing, marketing, and delivering on a timely and cost-effective basis enhancements or improvements to our platform, programs, or any new programs that respond to continued changes in market demands or new requirements from customers or channel partners, and any enhancements or improvements to our platform, programs, or any new programs may not achieve market acceptance or may otherwise be negatively impacted by third-party actions that are outside of our control. For example, we have developed GLP-1 Care Tracks to support members who are engaged in one of our cardiometabolic programs to enable their success before, during, and after GLP-1 therapy, and we recently announced the capability to prescribe GLP-1 therapies and other AOMs as an extension of those offerings. The GLP-1 therapeutic space is new and rapidly evolving, and actions by employers, health plans, PBMs, pharmaceutical companies, and other third parties. including federal, state, or local governments, could negatively impact the adoption of our GLP-1 Care Tracks and prescribing offerings. For example, if pharmaceutical companies restrict cost rebates or other incentives for GLP-1s for employers who place conditions on the use of GLP-1s (such as participation in our program), market acceptance of our GLP-1 Care Tracks and prescribing offerings could be materially and adversely affected. Conversely, certain health plans, PBMs, employers, or other customers or channel partners may require that members enroll in, and engage with, one of our GLP-1 Care Tracks and/or obtain prescriptions through our prescribing offerings as a condition of receiving GLP-1 medications. When health plans, PBMs, employers, or other customers or channel partners require that members enroll in, and engage with, one of our GLP-1 Care Tracks and/or obtain prescriptions through our prescribing offerings as a condition of receiving GLP-1 prescriptions, we may provide data reporting that those customers and channel partners use in their review or adjudication of prescription requests and/or prescriptions necessary for obtaining the medications. If our data reporting or prescribing systems or processes are delayed, disrupted, or otherwise fail to work as intended, the prescription processes of our customers and channel partners may be negatively affected, which may result in delayed prescriptions or medications, which in turn could cause member harm or materially and adversely impact our relationships with customers and channel partners. Although, as of June 30, 2026, FDA-approved labels guided that GLP-1 therapies prescribed in adults for obesity or chronic weight management should be prescribed concurrently with a behavioral and lifestyle treatment plan, members could react negatively to these requirements. Although these conditions are not imposed by Omada directly, members could nevertheless attribute these requirements to us and develop a negative perception of us or our programs and our business, which could harm our brand and reputation. Moreover, if the use of GLP-1 therapy for weight loss receives negative publicity and/or one or more GLP-1s are determined to be harmful, the use of GLP-1s for weight loss could decline, which would reduce demand for our GLP-1 Care Tracks and prescribing offerings and, in turn, our business, financial condition, results of operations, and prospects may be materially and adversely affected. Since developing our platform and programs and acquiring new technologies is complex, the timetable for the release of new programs and enhancements to existing programs and our platform is difficult to predict, and we may not offer new programs and updates to existing programs and our platform as rapidly as our customers or channel partners require or expect. Any new programs or updates to our platform that we develop or acquire may not be introduced in a timely or cost-effective manner, may contain errors or defects, or may not achieve the broad market acceptance necessary to generate sufficient revenue. Moreover, even if we introduce new programs, we may experience a decline in revenue of our existing programs that is not offset by revenue from the new programs. For example, customers and channel partners may delay making purchases of new programs to permit them to make a more thorough evaluation of these programs or until industry and marketplace reviews become widely available. Some customers or channel partners may hesitate to migrate to a new platform or program due to concerns regarding the performance of the new platform or program. This could result in a temporary or permanent revenue shortfall and materially and adversely affect our business, financial condition, results of operations, and prospects.

Our programs are designed under the oversight of qualified healthcare professionals, and we train our Care Teams and require any external partners delivering care to comply with appropriate standards and protocol for care delivery and the recognition and management of escalation events. Our success depends in part on the ability of these healthcare professionals to obtain and maintain all necessary licenses, certifications, permits, and other approvals, and to provide services to members in compliance with applicable laws, including scope of practice laws, as well as our policies. Nevertheless, if future results or experience indicate that our programs cause unexpected or serious complications or other unforeseen negative effects, our members may seek significant compensation from us or our affiliated professional entities or cease using our platform and programs, or our customers or channel partners could cease doing business with us. We may also be contractually required to indemnify and hold harmless third parties, such as customers or channel partners, from the costs of member harm or injury. There can be no assurance that provisions typically included in our terms with members or in our agreements with our customers and channel partners that attempt to limit exposure to legal claims would be enforceable or adequate or would protect us or our affiliated professional entities from liabilities or damages. Even if a claim is not successful, any claim brought against us or our affiliated professional entities would likely be time-consuming and costly to defend and any claim arising from our programs could seriously damage our reputation and brand, our business, or the business of our affiliated professional entities. In addition, we may not carry insurance sufficient to compensate us for any losses that may result from such claims. As a result, we or our affiliated professional entities could face significant legal liability or harm to our or our affiliated professional entities' reputation, business, financial condition, results of operations, and prospects.

Economic downturns, market volatility, inflation, tariffs (including uncertainty related to the implementation and enforceability thereof), and uncertainty make it potentially very difficult for us and our customers and channel partners to accurately forecast and plan future business activities. During challenging economic times, our customers or channel partners may have difficulty gaining timely access to sufficient credit or obtaining credit on reasonable terms, which could impair their ability to make timely payments to us and adversely affect our revenue. Bank failures have had and in the future may have a similar impact on the ability or willingness of our customers and channel partners to make payments to us and the timing of collection of our receivables. If that were to occur, our financial results could be harmed. Furthermore, we have customers in a variety of different industries. A significant downturn in the economic activity attributable to any particular industry may cause organizations to react by reducing their capital and operating expenditures in general or by specifically reducing their spending on healthcare matters, including chronic care programs. In addition, our customers or channel partners may delay or cancel healthcare projects or seek to lower their costs by renegotiating contracts. To the extent purchases of our programs are perceived by existing or potential customers and channel partners to be discretionary, our revenue may be disproportionately affected by delays or reductions in general healthcare spending. Also, competitors may respond to challenging market conditions by lowering prices and attempting to lure away our business. Further, challenging economic conditions, including as a result of increased inflation and tariffs (including uncertainty related to the implementation and enforceability thereof), may impair the ability of our customers and channel partners to pay for the services they already have purchased from us, and as a result, our write-offs of accounts receivable could increase. We cannot predict the timing, strength, or duration of any economic slowdown or recovery. If the condition of the general economy or markets in which we operate worsens, our business, financial condition, results of operations, and prospects could be materially and adversely affected. In addition, certain of our physical therapy members are covered under health plans that require the member to cover a portion of their own healthcare expenses through the payment of member cost-sharing amounts, such as copayments, deductibles, or co-insurance. PPTG may not be able to collect the full amounts due with respect to these payments that are the member's financial responsibility. To the extent permitted by law, amounts not covered by third-party payers are the obligations of individual members for which PPTG may not receive whole or partial payment. Any increase in cost shifting from third-party payers to individual members, including as a result of high deductible plans for members, increases our collection costs and reduces overall collections, which we may not be able to offset such additional costs with sufficient revenue.

Historically, substantially all of our sales have been to customers and channel partners in the U.S. Expanding our business to attract customers, channel partners, and members in countries other than the U.S. in the future may be an element of our long-term business strategy and, to the extent we enter into international markets in the future, there are significant costs and risks inherent in conducting business in international markets. In addition, expansion into foreign markets would impose additional burdens on our executive and administrative personnel, finance, and legal teams, research and marketing teams, and general managerial resources. If we expand, or attempt to expand, into foreign markets, we will be subject to new business and regulatory risks, including: - multiple, conflicting, and changing laws and regulations such as tax laws, privacy, data protection, and AI-related laws and regulations, export and import restrictions, employment laws, regulatory requirements, and other governmental approvals, permits, and licenses, which may be more difficult to comply with than U.S. laws and regulations;- obtaining regulatory approvals or clearances where required for the sale of our programs and the delivery of connected devices provided in connection with our programs in various countries;- increased management, infrastructure, and legal compliance costs associated with having customers, channel partners, and members in multiple jurisdictions;- requirements to maintain data and the processing of that data on servers located within the U.S. or in such other countries;- protecting and enforcing our intellectual property rights;- complexities associated with managing multiple payer reimbursement regimes, including government payers;- logistics and regulations associated with shipping our wireless scales, blood pressure monitors, blood glucose monitors, and other connected devices and supplies;- competition from companies with significant market share in international markets and with a better understanding of user preferences in such markets;- financial risks, such as longer payment cycles, difficulty collecting accounts receivable, the effect of local and regional financial pressures on demand and payment for our programs, and exposure to foreign currency exchange rate fluctuations;- natural disasters, political and economic instability, including wars, terrorism, political unrest, public health threats, including pandemics, epidemics or outbreaks of disease, boycotts, curtailment of trade, and other market restrictions; and - regulatory and compliance risks that relate to maintaining accurate information and control over activities subject to regulation under the Foreign Corrupt Practices Act (the "FCPA"). Our ability to continue to expand our business and to attract talented employees, customers, channel partners, and members in various international markets will require considerable management attention and resources and is subject to the challenges of supporting a rapidly growing business in an environment of multiple languages, cultures, customs, legal systems, alternative dispute resolution systems, regulatory systems, and commercial infrastructures. We have limited experience with regulatory environments and market practices internationally, and we may not be able to penetrate or successfully operate in new markets. We may also encounter difficulty expanding into international markets because of limited brand recognition in certain parts of the world, leading to delayed acceptance of our programs by customers and channel partners in these international markets. If we are unable to expand internationally and manage the complexity of international operations successfully, it could have a material adverse effect on our business, financial condition, results of operations, and prospects. If our efforts to introduce our products into foreign markets are not successful, we may have expended significant resources without realizing the expected benefit. Ultimately, the investment required for expansion into foreign markets could exceed the results of operations generated from this expansion.

Severe weather, natural disasters, and other catastrophic events, including pandemics, epidemics or other public health crises, earthquakes, tsunamis, hurricanes, floods, fires, explosions, accidents, power outages, cyberattacks, telecommunications failures, mechanical failures, unscheduled downtimes, civil unrest, strikes, transportation interruptions, unpermitted discharges or releases of toxic or hazardous substances, other environmental risks, wars or other conflicts (including wars in Ukraine and the Middle East), sabotage, terrorist attacks, or other intentional acts of vandalism or misconduct could severely disrupt our operations, or the operations of third parties who supply the devices and other supplies provided in connection with our programs, connectivity of those devices, or services complementary to our programs, and have a material adverse effect on our business, financial condition, results of operations, and prospects. If a natural disaster or other catastrophic event occurs that prevents us or third-party suppliers from using all or a significant portion of our or their headquarters or other facilities, that damages critical infrastructure, such as our enterprise financial systems or manufacturing resource planning and enterprise quality systems, or that otherwise disrupts operations, it may be difficult or, in certain cases, impossible, for us to continue our business for a substantial period of time. A mechanical failure or disruption affecting any major operating line may result in a disruption to our ability to supply customers, channel partners, and members, and standby capacity may not be available. The disaster recovery and business continuity plans we have in place currently are limited and are unlikely to prove adequate in the event of a serious disaster or similar catastrophic event. The potential impact of any disruption would depend on the nature and extent of the damage caused by a disaster. We may incur substantial expenses as a result of the limited nature of our disaster recovery and business continuity plans, which, particularly when taken together with our lack of earthquake insurance, could have a material adverse effect on our business, financial condition, results of operations, and prospects. Furthermore, integral parties in our supply chain are similarly vulnerable to natural disasters or other sudden, unforeseen, and severe adverse events. If such an event were to affect our supply chain, it could have a material adverse effect on our business, financial condition, results of operations, and prospects.