What changed in this filing

/stocks — the workspaceLOADING

Item 1A. Risk Factors

2025-02-27 compared with 2024-02-28 · 106 added, 109 removed, 639 unchanged (25% of the section changed)

15 unchanged sentences

Therefore, changes in the reimbursement rates, coverage offered by these payors or loss of in-network status may adversely impact our business and results of operations more than changes implemented by other payors.

We plan to be selective with our payor strategy.

If we choose to expand our relationships with large payors relative to more numerous smaller payors, these large payors may determine the reimbursement rates and coverage for more of our patients.

addition, we may be unable to enter new payor contracts on favorable terms, or at all.

We are selective with our payor strategy and have dedicated resources for payor engagement.

As we expand our relationships with large payors relative to more numerous smaller payors, these large payors may determine the reimbursement rates and coverage

for more of our patients.

In addition, we may be unable to enter new payor contracts on favorable terms, or at all.

In some cases, our revenue decreases if our volume or reimbursement decreases, but our expenses, including clinician compensation, may not decrease proportionately.

Further, as we negotiate and renew payor contracts, we may not be able to secure favorable rates, and may never be able to achieve rate parity with physical healthcare reimbursement.

Reimbursement rates determined by our contracts with larger payors have and may continue to have significant impacts on our total revenue per visit and cash flows.

Our commercial payor contracts are typically structured as fee-for-service arrangements, pursuant to which we, or our supported practices, collect the fees for patient services.

23 unchanged sentences

We continually execute a number of growth initiatives, strategies and operating plans designed to enhance our business.

For example, our strategy includes recruiting new clinicians, growing our business by opening de novo centers, building our relationships with payors and developing strategic relationships with other primary care and specialist physicians to offer an integrated care model and acquiring strategic high-quality existing centers.

For example, our strategy includes recruiting new clinicians, growing our business by opening select de novo centers, building our relationships with payors and developing strategic relationships with other primary care and specialist physicians to offer an integrated care model and acquiring strategic high-quality existing centers.

The anticipated benefits from these efforts are based on several assumptions that may prove to be inaccurate.

Moreover, we may not be able to successfully complete these growth initiatives, strategies and operating plans and realize all of the benefits, including growth targets, that we expect to achieve, or it may be more costly to do so than we anticipate.

For example, we may have increased expenses related to clinician education and licensing, as well as supervising, if we are a first employer for newly recruited clinicians.

We may also pivot or delay our growth strategies, which may result in slower rates of net clinician growth or revenue growth compared to prior periods of significant growth.

3 unchanged sentences

These risks include, among others, labor market dynamics, federal and state antitrust enforcement, delays in the anticipated timing of activities related to such growth initiatives, strategies and operating plans, increased difficulty and cost in implementing these efforts, including difficulties in complying with evolving regulatory requirements, and the incurrence of other unexpected costs associated with operating the business.

Moreover, our continued implementation of these programs may disrupt our operations and performance.

Moreover, our continued implementation of these

programs may disrupt our operations and performance.

If, for any reason, the benefits we realize are less than our estimates or the implementation of these growth initiatives, strategies and operating plans negatively impacts our operations or costs more or takes longer to effectuate than we expect, or if our assumptions prove inaccurate, our business, results of operations and financial condition may be harmed.

If we fail to manage our growth effectively, our expenses could increase more than expected, our revenue may not increase proportionally or at all, and we may be unable to execute on our business strategy.

Our significant growth in recent periods has and may continue to put strain on our business, operations and employees.

Our significant growth in prior periods has and may continue to put strain on our business, operations and employees.

We have also significantly increased the number of patient visits conducted over this period.

17 unchanged sentences

Rising expenses including wage inflation could adversely affect our ability to attract and retain high-quality clinicians.

The substantial management time and resources that our new clinicians require may result in disruption to our existing business operations, which may harm our profitability.

The substantial management time and resources that our new clinicians require may result in disruption to our existing business operations, which may harm our profitability, and these commitments may be amplified if we continue to recruit a significant number of clinicians early in their careers.

Our inability to successfully address these challenges and other factors may adversely affect the quality and profitability of our business operations as we pursue our growth and human capital strategy.

3 unchanged sentences

We cannot be certain that we will produce the anticipated revenues or return on investment or that our performance will not be materially adversely affected by new or expanded competition in our market areas.

We may acquire existing high-quality centers as part of our long-term business strategy and may acquire other companies or technologies, which could divert our management’s attention, result in dilution to our stockholders and otherwise disrupt our operations, and we may have difficulty integrating any such acquisitions successfully or realizing the anticipated benefits therefrom.

operations, and we may have difficulty integrating any such acquisitions successfully or realizing the anticipated benefits therefrom.

Historically, a part of our business strategy has been the acquisition of existing high-quality centers with in-network payor relationships.

We may make acquisitions in the future pursuant to our strategy and may also seek to acquire or invest in businesses or technologies that we believe could complement or expand our business and our platform, enhance our capabilities or otherwise offer

growth opportunities.

The pursuit of potential acquisitions may divert the attention of management and cause us to incur various expenses in identifying, investigating and pursuing suitable acquisitions, whether or not they are consummated.

27 unchanged sentences

if any of our centers or our supported practices achieve poor results (or results that are lower than our competitors’) on patient satisfaction surveys, or if our standard charges are or are perceived to be higher than our competitors, we may attract fewer patients.

Additional quality measures and trends toward clinical or billing transparency, including recently enacted price transparency rules that would require third-party payors to make their pricing information publicly available, may have a negative impact on our competitive position and patient volumes, as patients may prefer to use lower-cost healthcare providers if they deliver services that are perceived to be similar in quality to ours.

Additional quality measures and trends toward clinical or billing transparency, including price transparency rules that require third-party payors to make their pricing information publicly available, may have a negative impact on our competitive position and patient volumes, as patients may prefer to use lower-cost healthcare providers if they deliver services that are perceived to be similar in

quality to ours.

Competition from specialized providers, medical practices, retailers, digital health companies and other parties could negatively impact our revenue and market share.

1 unchanged sentence

Further, our current or potential competitors may be acquired by third parties with greater available resources.

As a result, our competitors may be able to respond more quickly and effectively than we can to new or changing opportunities, technologies,

standards or patient or clinician requirements and may have the ability to initiate or withstand substantial price competition.

As a result, our competitors may be able to respond more quickly and effectively than we can to new or changing opportunities, technologies, standards or patient or clinician requirements and may have the ability to initiate or withstand substantial price competition.

In light of these factors, even if our model is more effective than those of our competitors, current or potential patients or clinicians may choose to turn to our competitors.

11 unchanged sentences

In December 2020, in connection with the Consolidated Appropriations Act of 2021, the No Surprises Act introduced protections against surprise billing by providers that became effective on January 1, 2022.

The rule creates new protections against surprise billing and excessive cost sharing for healthcare consumers and creates a dispute resolution process to rectify cost disparities.

The rule created new protections against surprise billing and excessive cost sharing for healthcare consumers and created a dispute resolution process to rectify cost disparities.

The provider-specific portions of the Act require providers to submit a good faith estimate to uninsured patients (or patients who will not be submitting claims to their insurer) or to the patient’s insurer and can result in payment disputes if the resulting bill is substantially in excess of said estimate.

14 unchanged sentences

From time to time, we may operate in states that have not adopted laws related to parity between reimbursement rates for virtual services and in-person care, as presently less than half of states require reimbursement of payment parity for telehealth.

If we are not able to enter into regional payor contracts that provide for reimbursement parity between in-person and virtual services, private payors may not reimburse for virtual services at the same rates as in-person care for all patients within that market.

If we are not

able to enter into regional payor contracts that provide for reimbursement parity between in-person and virtual services, private payors may not reimburse for virtual services at the same rates as in-person care for all patients within that market.

Currently, our reimbursement rates for virtual services and in-person care are substantially similar.

This is driven by contractual arrangements with our payor partners or payor policies.

would negatively impact our revenue with respect to such markets, and as a result, our business, financial condition and results of operations.

If we are not able to enter into or renew payor contracts on these terms or if payor policies change, we may receive reimbursement for virtual services that is less than comparable to in-person services in such states, which would negatively impact our revenue with respect to such markets, and as a result, our business, financial condition and results of operations.

Failure to timely or accurately bill for our services could have a negative impact on our patient service revenue, credit losses and cash flow.

26 unchanged sentences

Furthermore, the legal, document production and other costs associated with complying with these inspections, reviews, audits or investigations could be significant.

In addition, any of these events, whether or not ultimately substantiated, may result in reputational harm that could have a material adverse effect on our business, financial condition and results of operations.

We are dependent on credentialing our clinicians under our insurance contracts at the time of hire.

7 unchanged sentences

Our business is dependent on maintaining effective information systems as well as the integrity and timeliness of the data we use to serve our patients, support our clinicians and payor partners and operate our business.

Because of the large amount of data that we collect and manage, it is possible that hardware failures or errors in our systems could result in data loss or corruption or cause the

information that we collect to be incomplete or contain inaccuracies that our partners regard as significant.

Because of the large amount of data that we collect and manage, it is possible that hardware failures or errors in our systems could result in data loss or corruption or cause the information that we collect to be incomplete or contain inaccuracies that our partners regard as significant.

If our data were found to be inaccurate or unreliable due to fraud or other error, or if we, or any of the third-party vendors we engage, were to fail to maintain information systems and data integrity effectively, we could experience operational disruptions that may impact our patients and clinicians and hinder our ability to provide care to patients, retain and attract patients, establish reserves, report financial results timely and accurately and maintain regulatory compliance, among other things.

13 unchanged sentences

Additional development projects may be needed or arise in the future and we may not have the necessary resources to complete such development projects.

Further, the technological advances of our competitors or future competitors may result in our technologies or future technologies become uncompetitive or obsolete.

Further, the technological advances of our competitors or future competitors may result in our technologies or future technologies becoming uncompetitive or obsolete.

Our failure to effectively invest in, implement improvements to and properly maintain the uninterrupted operation and data integrity of our information technology and other business systems could adversely affect our results of operations, financial condition and cash flow.

8 unchanged sentences

Moreover, we could encounter delays and other obstacles in our attempt to develop alternatives.

We lease all of our centers and may experience risks relating to lease termination, lease expense escalators, lease extensions and special charges.

We lease all of our centers and may experience risks relating to lease terminations, lease expense escalators, lease extensions and special charges.

We currently lease all of our centers.

Our leases are typically on terms ranging from one to seven years.

Each of our leases provides that the lessor may terminate the lease, subject to applicable cure provisions, for a number of reasons, including failure to pay rent as specified or default of terms of the lease that are not cured within a specified notice period including, but not limited to, abandonment of the space, use of the space of a purpose not permitted under the lease, failure to maintain the premises in good condition, or creation and maintenance of a nuisance.

abandonment of the space, use of the space of a purpose not permitted under the lease, failure to maintain the premises in good condition, or creation and maintenance of a nuisance.

If a lease agreement is terminated, we may not be able to enter into a new lease agreement on similar or better terms or at all.

Our lease obligations often include annual fixed rent escalators ranging between 2% and 3% or variable rent escalators based on a consumer price index.

These escalators could impact our ability to satisfy certain obligations and financial covenants and place an

additional burden on our results of operations, liquidity and financial condition, particularly if such escalator rates outpace growth in our operating results.

These escalators could impact our ability to satisfy certain obligations and financial covenants and place an additional burden on our results of operations, liquidity and financial condition, particularly if such escalator rates outpace growth in our operating results.

As we continue to expand and have leases with different start dates, it is likely that some number of our leases will expire each year.

3 unchanged sentences

Leasing centers pursuant to binding lease agreements may limit our ability to exit markets.

For instance, if a center subject to a lease becomes unprofitable, we may be required to continue operating such center or, if allowed by the landlord, to close such center, we may remain obligated for the lease payments on such center.

In connection with our real estate optimization initiative in 2023, we incurred special charges relating to the closing of such centers, including lease termination costs and impairment charges, which reduced and may continue to reduce our profits and adversely affect our business, financial condition or results of operations.

For instance, if a center subject to a lease becomes unprofitable, we may be required to continue operating such center or, if allowed by the landlord, to close such center, but we may remain obligated for the lease payments on such center.

In connection with our real estate optimization initiative, in 2024, we incurred special charges relating to the closing of such centers, including certain gains and losses related to early lease termination of previously abandoned real estate leases, which reduced our profits.

Upon an event of default, remedies available to our landlords generally include, without limitation, terminating such lease agreement, repossessing and reletting the leased properties and requiring us to remain liable for all obligations under such lease agreement, including the difference between the rent under such lease agreement and the rent payable as a result of reletting the leased properties, or requiring us to pay the net present value of the rent due for the balance of the term of such lease agreement.

11 unchanged sentences

We are subject, and in the future may become subject from time to time, to legal proceedings, claims and inquiries, such as claims brought by our partners in connection with commercial disputes, consumer class action claims, employment claims made by our current or former employees or other claims or proceedings.

For example, in the first half of 2023, two related hybrid collective/class action lawsuits, captioned Armand et al.

LifeStance Health Group, Inc.

and Jessica McAfee et al.

LifeStance Health Group, Inc.

, were filed against the Company by a putative collective or class representing employees of the Company related to advances on compensation and alleged underpayments for time worked, and on April 26, 2023, a class action litigation captioned Strong v.

For example, on April 26, 2023, a class action litigation captioned Strong v.

LifeStance Health Group, Inc.

was filed against the Company by a putative class representing users of the Company's website who allege various privacy-related claims premised on the Company's use of pixel technologies on its website.

A district court judge dismissed the complaint without prejudice on December 19, 2023.

The plaintiff has filed an amended complaint and the matter remains ongoing.

Litigation may result in substantial costs, settlement and judgments and may divert management’s attention and resources, which may substantially harm our business, financial condition and results of operations.

2 unchanged sentences

Natural or man-made disasters and other similar events may significantly disrupt our business and negatively impact our business, financial condition and results of operations.

Our centers may be harmed or rendered inoperable by natural or man-made disasters, including earthquakes, power outages, fires, floods, nuclear disasters and acts of terrorism or other criminal activities, which make it difficult or impossible for us to operate our business for some period of time.

Our centers may be harmed or rendered inoperable by natural or man-made disasters, including earthquakes, hurricanes, power outages, fires, floods, nuclear disasters and acts of terrorism or other criminal activities, which make it difficult or impossible for us to operate our business for some period of time.

Although we deliver care in both in-person and digital settings, such disruptions in our operations could negatively impact our business and results of operations and harm our reputation.

Although we maintain an insurance policy covering damage to property we lease, such insurance may not be sufficient to compensate for losses that may occur.

losses or damages could harm our business, financial condition and results of operations.

Although we maintain an insurance

policy covering damage to property we lease, such insurance may not be sufficient to compensate for losses that may occur.

Any such losses or damages could harm our business, financial condition and results of operations.

In addition, our physician partners’ facilities may be harmed or rendered inoperable by such natural or man-made disasters, which may cause disruptions, difficulties or other negative effects on our business and operations, with respect to our integrated care model.

43 unchanged sentences

If we engage in additional debt financing, we may be required to accept terms that restrict our ability to incur additional indebtedness, force us to maintain specified liquidity or other ratios or restrict our ability to pay dividends or make acquisitions.

In addition, the covenants in the Credit Agreement among LifeStance Health Holdings, Inc., Lynnwood Intermediate Holdings, Inc., Capital One, National Association, and each lender party thereto, dated May 4, 2022, as amended (the “2022 Credit Agreement”), limits our ability to obtain additional debt, and any failure to adhere to these covenants would result in penalties or defaults that could further restrict our liquidity or limit our ability to obtain financing.

In addition, the covenants in the Credit Agreement among LifeStance Health Holdings, Inc., Lynnwood Intermediate Holdings, Inc., Capital One, National Association, and each lender party thereto, dated December 19, 2024 (the “2024 Credit Agreement”), limits our ability to obtain additional debt, and any failure to adhere to these covenants would result in penalties or defaults that could further restrict our liquidity or limit our ability to obtain financing.

If we need additional capital and cannot raise it on acceptable terms, or at all, we may not be able to, among other things:

80 unchanged sentences

If we are required to adapt our business model, we may be limited to only in-person services, which may have a material adverse effect on our business, financial condition and results of operations.

Several states in which we operate have adopted competition and healthcare planning laws that affect transactions in the healthcare industry.

Several states in which we operate have adopted competition and healthcare planning laws that affect transactions in the healthcare industry, including California, Illinois, Indiana, Massachusetts, Minnesota, Nevada, New York, Oregon, and Washington, and states generally continue to propose such laws.

Some states require notification, filings, and/or approvals by state agencies with respect to proposed transactions involving healthcare providers.

Such processes can take significant time, require filing fees, result in conditions that require certain operational changes and include regular annual reviews regarding the cost and quality of services, among other topics.

For example, California's law requires at least 90-days advance notification to the Office of Health Care Affordability within the state Department of Health Care Services of certain proposed transactions that close on or after April 1, 2024 and require extensive documentation in connection with the submission of documents.

For example, California's law requires at least 90-days advance notification to the Office of Health Care Affordability within the state Department of Health Care Services of certain proposed transactions and require extensive documentation in connection with the submission of documents.

These laws and the level of enforcement by the respective state agencies are subject to continuous change and interpretation, and compliance with these laws could adversely affect our business.

13 unchanged sentences

state authorities in some jurisdictions may find that our contractual relationships with outpatient mental health practices, which govern the provision of medical and virtual services and the payment of administrative and operations support fees, violate laws prohibiting the corporate practice of medicine or other professions and fee-splitting.

And lawsuits alleging violation of such state doctrines are not uncommon, with a present case against a national emergency physician staffing company that began in California in January 2024 that could have an effect on our business operations in California.

And lawsuits alleging violation of such state doctrines are not uncommon—in 2024, a case against a national emergency physician staffing company in California challenging a model of operation similar to our own was voluntarily dismissed without a decision after the company elected to exit the California market, resulting in the state's loss of jurisdiction.

The extent to which each state may consider particular actions or contractual relationships to constitute improper influence of professional judgment varies across the states and is subject to change and to evolving interpretations by state licensing boards and state attorneys general, among others.

1 unchanged sentence

Our activities and arrangements, if challenged, could be found to be in violation with the law.

Additionally, it is possible that the laws and rules governing the practice of medicine or other professions, including the provision of virtual services, and fee splitting in one or more jurisdictions may change in a manner adverse to our business.

While the management contracts prohibit us from controlling, influencing or otherwise interfering with the

practice of medicine and other professions by the supported clinicians, and provide that clinicians retain exclusive control and responsibility for all aspects of the practice of medicine or other professions and the delivery of clinical services, there can be no assurance that our contractual arrangements and activities with supported practices will be free from scrutiny from U.S.

Additionally, it is possible that the laws and rules governing the practice of medicine or other professions, including the provision of

virtual services, and fee splitting in one or more jurisdictions may change in a manner adverse to our business.

While the management contracts prohibit us from controlling, influencing or otherwise interfering with the practice of medicine and other professions by the supported clinicians, and provide that clinicians retain exclusive control and responsibility for all aspects of the practice of medicine or other professions and the delivery of clinical services, there can be no assurance that our contractual arrangements and activities with supported practices will be free from scrutiny from U.S.

state authorities, and we cannot guarantee that subsequent interpretation of the corporate practice and fee-splitting laws will not circumscribe our business operations.

2 unchanged sentences

While we expect that our relationships with our supported practices will continue, a material change in our relationship with these entities, or among the supported practices, whether resulting from a dispute among the entities, a challenge from a governmental regulator, a change in government regulation, or the loss of these relationships or contracts with outpatient mental health practices, could impair our ability to provide services to our patients and could harm our business.

The impact of healthcare reform legislation and other changes in the healthcare industry and in healthcare spending on us is currently unknown, but may harm our business.

The impact on us of healthcare reform legislation and other changes in the healthcare industry and in healthcare spending, including as a result of the 2024 elections, is currently unknown, but may harm our business.

Our revenue is dependent on the healthcare industry and could be affected by changes in healthcare spending, reimbursement and policy.

2 unchanged sentences

Since its enactment, there have been judicial and Congressional challenges to certain aspects of the ACA as well as efforts to repeal or replace certain aspects of the ACA.

While efforts to repeal all or part of the ACA have subsided, we cannot be certain that there will not be further legislative efforts or judicial challenges in the future.

There may also be renewed interest in challenging the ACA as a result of the upcoming 2024 election.

In addition to judicial challenges, the Biden administration or U.S.

Congress may advance new healthcare policy goals and objectives through statute, regulation and executive order.

For example, the Biden administration has indicated an intent to propose a public health insurance option, which, if enacted, could significantly change the competitive landscape among commercial insurance carriers.

While efforts to repeal all or part of the ACA have generally subsided, we cannot be certain that there will not be further legislative efforts or judicial challenges in the future, or how the ACA will be upheld by the Trump administration.

In addition to judicial challenges, the Trump administration or U.S.

Congress may advance new healthcare policy goals and objectives or reverse existing healthcare policy goals, through statute, regulation and executive order.

For example, premium subsidies for the ACA are set to expire in 2025, which without renewal will cause premium increases for the majority of ACA enrollees in 2026 and could result in an increase in the number of uninsured.

The control of the House and Senate by a single party beginning in 2025, may enable broad policy changes in the healthcare industry, potentially affecting our business.

Other legislative changes to provider reimbursement have been proposed and adopted since the ACA was enacted.

12 unchanged sentences

Because of the extreme sensitivity of the information we store and transmit, the security features of our and our third-party vendors’ computer, network and communications systems infrastructure are critical to the success of our business.

Our security features and processes or our vetting and oversight of third parties and related hardware and software may not be sufficient for all circumstances.

Our security features and processes or our vetting and oversight of third parties and related hardware and software may not be sufficient

for all circumstances.

We also exercise limited control over third-party vendors and their computer systems and choice of software, which increases our vulnerability to problems with the technology and information services they provide.

Determined threat actors would likely be able to penetrate our security or the security of our vendors with enough skills, resources, and time, and they may

evade detection for extended periods of time.

A breach or failure of our or our third-party vendors’ network, hosted service providers or vendor systems could result from a variety of circumstances and events, including third-party action, employee negligence or error, malfeasance, computer viruses, cyber-attacks by computer hackers such as denial-of-service and phishing attacks, nation-state attacks, political protests, failures during the process of upgrading or replacing software and databases, power outages, hardware failures, telecommunication failures, software errors or incompatibility, user errors or catastrophic events.

Third parties may use our data in ways that violate their contractual commitment or that we did not appreciate or anticipate when contracting.

While we have implemented processes, procedures and controls designed to help mitigate risk and protect the integrity, confidentiality and security of the confidential and personal information under our control, we cannot assure you that any security measures that we or our third-party service providers implement will be effective in preventing security incidents, disruptions, cyberattacks, or other similar events.

Determined threat actors would likely be able to penetrate our security or the security of our vendors with enough skills, resources, and time, and they may evade detection for extended periods of time.

A breach or failure of our or our third-party vendors’ network, hosted service providers or vendor systems could result from a variety of circumstances and events, including third-party action, employee negligence or error, malfeasance, computer viruses, cyber-attacks by computer hackers such as denial-of-service, ransomware, business email compromise, and phishing attacks, nation-state attacks, political protests, failures during the process of upgrading or replacing software and databases, power outages, hardware failures, telecommunication failures, software errors or incompatibility, user errors or catastrophic events.

Information security risks have generally increased in recent years because of the proliferation of new technologies and the increased sophistication and activities of perpetrators of cyber-attacks.

We are also dependent on a technology supply chain that involves many third parties, some of whom may not be known to us, and each of these companies may also be a source of potential risk to our patients, operations and reputation.

Hackers and data thieves are increasingly sophisticated and operating large-scale and complex automated attacks, including on companies within the healthcare industry.

In addition, the competition for talent in the data privacy and cybersecurity space is intense, and we may be unable to hire, develop or retain suitable talent capable of adequately detecting, mitigating or remediating these risks.

Our failure to adhere to, or successfully implement processes in response to, evolving cybersecurity threats and changing legal or regulatory requirements in this area could result in legal liability or damage to our reputation in the marketplace.

As cyber threats continue to evolve, we and our third-party vendors may be unable to anticipate all potential threats.

2 unchanged sentences

A security incident may even remain undetected for an extended period, and we or our third-party vendors may be unable to anticipate such threats and attacks or implement adequate preventive measures.

For example, in February 2024, UnitedHealth Group announced that its Change Healthcare information technology systems was being taken offline for an undefined period, which could harm our operations, including our ability to process insurance claims, collect payments and confirm insurance eligibility of patients, and the ability of third-party pharmacies to fill electronic prescriptions our clinicians may write for patients.

For example, in February 2024, UnitedHealth Group announced that its Change Healthcare information technology systems were being taken offline for an undefined period, which impacted our operations, including our ability to process insurance claims, collect payments and confirm insurance eligibility of patients, and the ability of third-party pharmacies to fill electronic prescriptions our clinicians write for patients.

Such failures or breaches of our or our third-party vendors’ security measures, or our or our third-party vendors’ inability to effectively resolve such failures or breaches in a timely manner, could severely damage our reputation, adversely affect patient, provider or investor confidence in us, and reduce the demand for our services from existing and potential patients.

In addition, we could face litigation, damages for contract breach, monetary penalties or regulatory actions for violation of applicable laws or regulations, and incur significant costs to comply with applicable data breach notification laws and to implement remedial measures to prevent future occurrences and mitigate past violations.

Although we maintain insurance covering certain security and privacy damages and related expenses, we may not carry insurance or maintain coverage sufficient to compensate for all liability and in any event, insurance coverage would not address the reputational damage that could result from a security incident.

Our Board of Directors is briefed periodically on cybersecurity and risk management issues and we have implemented a number of processes to avoid cyber threats and to protect privacy.

However, the processes we have implemented in connection with such initiatives may be insufficient to prevent or detect improper access to confidential, proprietary or sensitive data, including personal data.

Should an attacker gain access to our network or the network of our third-party vendor, including by way of example, using compromised credentials of an authorized user, we are at risk that the attacker might successfully leverage that access to compromise additional systems and data.

Certain measures that could increase the security of our systems, such as data encryption (including data at rest encryption), heightened monitoring and logging, scanning for source code errors or deployment of multi-factor authentication, take significant time and resources to deploy broadly, and such measures may not be deployed in a timely manner or be effective against an attack.

In addition, we could face litigation (including class action claims), damages for breach of contract, monetary penalties or regulatory actions for violation of applicable laws or regulations, and incur significant costs to comply with applicable data breach notification laws and to implement remedial measures to prevent future occurrences and mitigate past incidents.

Although we maintain insurance coverage that may cover certain liabilities and expenses in connection with security breaches and other security incidents, we cannot be certain that our insurance coverage will be sufficient to compensate for all liability, that insurance will continue to be available to us on commercially reasonable terms (if at all), or that any insurer will not deny coverage as to any future claim, and in any event, insurance coverage would not address the reputational damage that could result from a security incident.

As cybersecurity threats continue to evolve, we may be required to expend significant additional resources to continue to modify or enhance our protective measures or to investigate and remediate any information security vulnerabilities.

The inability to implement, maintain and upgrade adequate safeguards could have a material adverse effect on our business.

Our information systems must be continually updated, patched and upgraded to protect against known vulnerabilities.

The volume of new vulnerabilities has increased markedly, as has the criticality of patches and other remedial measures.

In addition to remediating newly identified vulnerabilities, previously identified vulnerabilities must also be continuously addressed.

Accordingly, we are at risk that cyber-attackers exploit these known vulnerabilities before they have been addressed.

Due to the systems and platforms that we operate, the increased frequency at which vendors are issuing security patches to their products, the need to test patches and, in some cases, coordinate with clients and vendors, before they can be deployed, we continuously face the substantial risk that we cannot deploy patches in a timely manner.

These risks can be heightened as we acquire and work to integrate additional centers.

We are also dependent on third-party vendors to keep their systems patched and secure in order to protect our information systems and data.

Any failure related to these activities and any breach of our information systems could result in significant liability and have a material adverse effect on our business, reputation and financial condition.

Our use and disclosure of PII, including PHI, is subject to federal and state privacy and security regulations, and our failure to comply with those regulations or to adequately secure such information we hold could result in significant liability or reputational harm and, in turn, substantial harm to our supported practices, supported clinicians, patient base and revenue.

The privacy and security of PII stored, maintained, received or transmitted electronically is a major issue in the United States.

While we strive to comply with all applicable privacy and security laws and regulations, as well as our own posted privacy policies, legal standards for privacy, including but not limited to “unfairness” and “deception,” as enforced by the Federal Trade Commission

and state attorneys general and comprehensive privacy laws in more than a dozen states, continue to evolve and any failure or perceived failure to comply may result in proceedings or actions against us by government entities or others, or could cause us to lose customers, which could have a material adverse effect on our business.

Recently, there has been an increase in public awareness of privacy issues in the wake of revelations about the activities of various government agencies and in the number of private privacy-related lawsuits filed against companies.

Any allegations about us, our supported practices or our supported clinicians with regard to the collection, processing, use, disclosure, or security of PII or other privacy-related matters, even if unfounded and even if we are in compliance with applicable laws, could damage our reputation and harm our business.

Our use and disclosure of PII, including PHI, is subject to federal and state privacy and security laws and regulations, and our failure to comply with those regulations or to adequately secure such information we hold could result in significant liability or reputational harm and, in turn, substantial harm to our supported practices, supported clinicians, patient base and revenue.

The privacy and security of PII stored, maintained, received or transmitted electronically is a significant issue in the United States.

Our failure or perceived failure to comply may result in proceedings or actions against us by government entities or others, or could cause us to lose customers, which could have a material adverse effect on our business.

Recently, there has been an increase in public awareness of privacy issues and in the number of private privacy-related lawsuits filed against companies.

Any allegations about us, our supported practices or our supported clinicians with regard to the collection, processing, use, disclosure, or security of PII or other privacy-related matters, even if unfounded, could damage our reputation and harm our business.

We also publish statements to our patients and stakeholders that describe how we handle and protect personal information.

If federal or state regulatory authorities or private litigants consider any portion of these statements to be deceptive or misleading, either by what was said or what is omitted, we may be subject to claims of deceptive practices, which could lead to significant liabilities and consequences, including, without limitation, costs of responding to investigations, defending against litigation, settling claims and complying with regulatory or court orders.

Numerous foreign, federal and state laws and regulations govern collection, dissemination, use and confidentiality of personally identifiable health information, including state privacy and confidentiality laws (including state laws requiring disclosure of breaches) and HIPAA.

HIPAA establishes a set of basic national privacy and security standards for the protection of PHI, by health plans, healthcare clearinghouses and certain healthcare providers, referred to as covered entities, and the business associates with whom such covered entities contract for services, which includes us.

If federal or state regulatory authorities or private litigants consider any portion of these statements to be deceptive or misleading, either

by what was said or what is omitted, we may be subject to claims of deceptive practices, which could lead to significant liabilities and consequences, including, without limitation, costs of responding to investigations, defending against litigation, settling claims and complying with regulatory or court orders.

Numerous federal and state laws and regulations govern collection, dissemination, use and confidentiality of personally identifiable health information, including state privacy and confidentiality laws (including state laws requiring notification of data breaches) and HIPAA.

HIPAA establishes a set of baseline national privacy and security standards for the protection of PHI, by health plans, healthcare clearinghouses and certain healthcare providers, referred to as covered entities, and the business associates with whom such covered entities contract for services, which includes us.

Certain of our entities and supported practices are covered entities, while our management service entities are business associates.

7 unchanged sentences

HIPAA also authorizes state attorneys general to file suit on behalf of their residents.

While HIPAA does not create a private right of action allowing individuals to sue us in civil court for violations of HIPAA, its standards have been used as the basis for duty of care in state civil suits such as those for negligence or recklessness in the misuse or breach of PHI.

While HIPAA does not create a private right of action allowing individuals to bring lawsuits in civil court for violations of HIPAA, its standards have been used as the basis for duty of care in state civil suits such as those for negligence or recklessness in the misuse or breach of PHI.

Any such penalties or lawsuits could harm our business, financial condition, results of operations and prospects.

8 unchanged sentences

The proposed rule is subject to a regulatory suspension announced by the Biden administration and we do not know when (or if) the final rule will be published or whether there may be additional changes to the regulations, but when it is, we will need to evaluate and potentially update our HIPAA regulatory programs and documentation to ensure compliance with such requirements.

HHS OCR additionally issued a proposed rule in April of 2023 to modify existing standards permitting uses and disclosures of PHI when the PHI pertains to reproductive healthcare, which is defined broadly.

Additionally, tracking technologies generally used to collect and analyze information about user behavior and enhance the user experience may qualify as HIPAA violations and result in sanction.

In December 2022, OCR issued a bulletin titled, “Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates,” which sets forth broad-reaching guidance for HIPAA

covered entities and their business associates that utilize online tracking technologies on their webpages and applications.

In the guidance, OCR takes the position that when individuals use regulated entities’ websites, the individual information gleaned from that use (including IP address, geographic location, or other unique identifying code) may include PHI, and such information cannot be disclosed to a tracking vendor in a manner that would constitute an impermissible disclosure under HIPAA (e.g., disclosure without a valid HIPAA authorization or business associate agreement (“BAA”)) or any other violations of HIPAA.

See “—Risks Related to Our Business and Our Industry—Litigation, including in connection with commercial disputes or employment claims, against us could be costly and time-consuming to defend.”

Additionally, online tracking technologies generally used to collect and analyze information about user behavior and enhance the user experience may qualify as HIPAA violations and result in sanction.

In December 2022, OCR issued a bulletin titled, “Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates,” which sets forth broad-reaching guidance for HIPAA covered entities and their business associates that utilize online tracking technologies on their webpages and applications.

In the guidance, OCR takes the position that when individuals use regulated entities’ websites, the individual information gleaned from that use (including, in certain circumstances, IP address, geographic location, or other unique identifying code) may include PHI, and such information cannot be disclosed to a tracking vendor in a manner that would constitute an impermissible disclosure under HIPAA (e.g., disclosure without a valid HIPAA authorization or business associate agreement (“BAA”)).

In March 2024, the OCR updated its 2023 guidance on the use of online tracking technologies on webpages and applications by HIPAA covered entities and business associates to address the disclosure of individually identifiable health information through unauthenticated, public-facing webpages.

The guidance was subject to court challenge, and its interpretation and enforcement remain subject to ongoing developments.

There have been several class action lawsuits, including against LifeStance, asserting that HIPAA covered entities and business associates improperly used or disclosed PHI through online tracking technologies.

See “—Risks Related to Our Business and

Our Industry—Litigation, including in connection with commercial disputes or employment claims, against us could be costly and time-consuming to defend.”

HHS OCR additionally published a final rule in April 2024 modifying existing standards permitting uses and disclosures of PHI when the PHI pertains to reproductive healthcare, which is defined broadly and may capture mental health treatment provided to women surrounding subjects such as pregnancy, miscarriage, abortion, and fertility.

The final rule became effective June 25, 2024, with compliance required by December 23, 2024, and generally prohibits the use or disclosure of PHI by a covered entity when said use or disclosure is to be used to conduct a criminal, civil, or administrative investigation into or impose a related liability on any person for the act of seeking, obtaining, providing, or facilitating reproductive healthcare, when such healthcare is lawful under the circumstances in which it is provided.

Covered entities are similarly prohibited from disclosing PHI to identify any person for the purpose of conducting such investigation or imposing such liability.

To implement this prohibition, covered entities that receive a request for PHI potentially related to reproductive healthcare are required to obtain a signed attestation that the use or disclosure of said PHI is not for a prohibited purpose, when said request is for health oversight activities, judicial and administrative proceedings, law enforcement purposes, or disclosures to coroners and medical examiners.

Compliance with this new rule will require careful monitoring of the evolving landscape of state laws surrounding reproductive healthcare so that we may remain compliant with both state and federal laws.

We may also be required to comply with the Federal Substance Abuse Confidentiality Regulations, known as 42 C.F.R.

14 unchanged sentences

In addition to fines and penalties imposed upon violators, some of these state laws also afford private rights of action to individuals who believe their personal information has been misused.

California has also implemented the California Consumer Privacy Act ("CCPA"), which came into effect on January 1, 2020, which increases privacy rights for California residents and imposes obligations on companies that process their personal information.

Among other things, the CCPA requires covered companies to provide new disclosures to California consumers and provide such consumers new data protection and privacy rights, including the ability to opt-out of certain sales of personal information.

The CCPA provides for civil penalties for violations, as well as a private right of action for certain data breaches that result in the loss of personal information.

This private right of action may increase the likelihood of, and risks associated with, data breach litigation.

The CCPA has been amended from time to time, and it is possible that further amendments will be enacted, but even in its current format remains unclear how various provisions of the CCPA will be interpreted and enforced.

Additionally, the recently passed California Privacy Rights Act (“CPRA”) has significantly modified the CCPA, including expanding consumers’ rights with respect to certain sensitive personal information, and creating a new state agency that is vested with authority to implement and enforce the CCPA and CPRA.

The majority of the CPRA provisions went into effect on January 1, 2023, with some requirements applying to data collected beginning January 1, 2022.

The CPRA significantly expanded the CCPA's data protection obligations.

Failure to comply with CCPA or CPRA could result in penalties for noncompliance of up to $7,500 per violation.

More than a dozen other states have now passed comprehensive privacy laws that will come into effect at various times over the next few years.

We will need to continue to evaluate our privacy program as the implementation of the law evolves and may need to make further modifications to our programs, which, if we fail to do so as required, may expose us to liability under the regulation.

When we implement new systems and/or upgrade existing systems used to store PII, we could be exposed to increased risk of data security breaches and failures.

There are many other state-based data privacy and security laws and regulations that may impact our business.

For example, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (together, the "CCPA") gives California residents certain privacy rights in the collection and use of their personal information, and take certain other acts in furtherance of those rights.

Failure to comply with the CCPA may result in, among other things, civil penalties of up to $7,500 per violation, as well as a private right of action for certain data breaches.

Additionally, California created a data protection agency authorized to implement and enforce the CCPA, which could result in increased enforcement.

While the CCPA contains an exemption for PHI subject to HIPAA, we may process other personal information that is subject to the CCPA.

In addition, almost 20 other states have now passed comprehensive privacy laws that have taken effect or will come into effect at various times over the next few years.

These comprehensive state privacy laws also provide exemptions for PHI subject to HIPAA or exempt covered entities and business associates entirely.

All of these evolving compliance and operational requirements impose significant costs that are likely to increase over time, may require us to modify our data processing practices and policies, divert resources from other initiatives and projects and could restrict the way services involving data are offered, all of which may adversely affect our results of operations.

1 unchanged sentence

State laws are changing rapidly and there is discussion in Congress of a new federal data protection and privacy law to which we may be subject.

There are many other federal and state-based data privacy and security laws and regulations that may impact our business.

For example, federal, state and local privacy and consumer protection laws also govern specific technologies that we employ or how we market to, and otherwise communicate with, individuals.

For example, the Controlling the Assault of Non-Solicited Pornography and

Marketing Act and the Telephone Consumer Protection Act (“TCPA”) impose specific requirements on communications with consumers.

The TCPA and analogous state laws, for instance, impose various consumer consent requirements and other restrictions on communications with consumers by phone, fax or text message.

TCPA violations can result in significant financial penalties, including penalties or criminal fines imposed by the Federal Communications Commission or fines of up to $1,500 per violation imposed through private litigation or by state authorities.

The TCPA provides for substantial penalties and statutory damages and has generated significant class action activity.

The costs of litigating and/or settling a TCPA or similar legal claim could be significant.

The interplay of federal and state laws may be subject to varying interpretations by courts and government agencies, creating complex compliance issues for us and our clients and potentially exposing us to additional expense, adverse publicity and liability.

Further, as regulatory focus on privacy issues continues to increase and laws and regulations concerning the protection of personal information expand and become more complex, these potential risks to our business could intensify.

Changes in laws or regulations

associated with the enhanced protection of certain types of sensitive data, such as PHI or PII, along with increased customer demands for enhanced data security infrastructure, could greatly increase our cost of providing our services, decrease demand for our services, reduce our revenue and/or subject us to additional liabilities.

Changes in laws or regulations associated with the enhanced protection of certain types of sensitive data, such as PHI or PII, along with increased customer demands for enhanced data security, could greatly increase our cost of providing our services, decrease demand for our services, reduce our revenue and/or subject us to additional liabilities.

In addition to the applicable federal and state laws, we are also subject to PCI DSS, a self-regulatory standard that requires companies that process payment card data to implement certain data security measures.

2 unchanged sentences

Industry groups may in the future adopt additional self-regulatory standards by which we are legally or contractually bound.

Because of the breadth of these laws and the narrowness of their exceptions and safe harbors, it is possible that our business activities can be subject to challenge under one or more of such laws.

The scope and enforcement of each of these laws is uncertain and subject to rapid change in the current environment of healthcare reform.

Federal, state and foreign enforcement bodies have recently increased their scrutiny of interactions between healthcare companies and healthcare providers, which has led to a number of investigations, prosecutions, convictions and settlements in the healthcare industry.

The evolving patchwork of differing state and federal privacy and data security laws increases the cost and complexity of operating our business and increases our exposure to liability, including from third-party litigation and regulatory investigations, enforcement, fines and penalties.

The scope and enforcement of each of these laws is uncertain and subject to rapid change, particularly, in the current environment of healthcare reform.

Federal and state enforcement bodies have recently increased their scrutiny of interactions between healthcare companies and healthcare providers, which has led to a number of investigations, prosecutions, convictions and settlements in the healthcare industry.

Any such investigations, prosecutions, convictions or settlements could result in significant financial penalties, damage to our brand and reputation, and a loss of customers, any of which could have an adverse effect on our business.

92 unchanged sentences

As a public company, we continue to incur significant legal, accounting, and other expenses that we did not incur as a private company.

The Sarbanes-Oxley Act of 2002, the Dodd-Frank Wall Street Reform and Consumer Protection Act, the listing

requirements of Nasdaq, and other applicable securities rules and regulations impose various requirements on public companies, including establishment and maintenance of effective disclosure and financial controls and corporate governance practices.

The Sarbanes-Oxley Act of 2002, the Dodd-Frank Wall Street Reform and Consumer Protection Act, the listing requirements of Nasdaq, and other applicable securities rules and regulations impose various requirements on public companies, including establishment and maintenance of effective disclosure and financial controls and corporate governance practices.

We expect that we will need to hire additional accounting, finance, and other personnel in connection with our efforts to comply with the requirements of being, a public company, and our management and other personnel will need to devote a substantial amount of time towards maintaining compliance with these requirements.

50 unchanged sentences

Any person or entity purchasing or otherwise acquiring any interest in shares of our capital stock shall be deemed to have notice of and to have consented to these provisions.

These provisions may limit a stockholder’s ability to bring a claim in a judicial forum

that it finds favorable for disputes with us or our directors, officers or other employees, which may discourage such lawsuits against us and our directors, officers and employees.

These provisions may limit a stockholder’s ability to bring a claim in a judicial forum that it finds favorable for disputes with us or our directors, officers or other employees, which may discourage such lawsuits against us and our directors, officers and employees.

Alternatively, if a court were to find these provisions of our certificate of incorporation inapplicable to, or unenforceable in respect of, one or more of the specified types of actions or proceedings, we may incur additional costs associated with resolving such matters in other jurisdictions, which could adversely affect our business and financial condition.

38 unchanged sentences

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1A. Risk Factors