Doximity, Inc. (DOCS)

Criticisms on file

No material criticisms on file for this pillar.

Disclosed initiatives

• Cloud Infrastructure Reliance

  Company relies on Amazon Web Services and Google Cloud for computing and storage, outsourcing physical infrastructure carbon footprint to third-party providers.

  Indirect emissions management; no direct control or transparency over provider sustainability practices.

Criticisms on file

• Workforce Cybersecurity Risk from Remote Work

  Source: DOCS_10k.txt, Risk Factors: 'A substantial portion of our workforce is currently working remotely on a part- or full-time basis. This could increase our cyber security risk, create data accessibility concerns, and make us more susceptible to communication disruptions.'

Disclosed initiatives

• Physicians-First Philosophy

  Company states it prioritizes member (physician) interests over revenue expansion when conflicts arise; foregoes certain revenue opportunities perceived as misaligned with member welfare.

  Intended to build trust and engagement; no quantified outcome metrics disclosed.
• Talent Acquisition & Retention Programs

  Competitive equity compensation packages, stock-based incentive programs for executives and employees. Stock-based compensation expense increased from $72.4M (FY2025) to $121.6M (FY2026), reflecting expanded awards for new hires and existing staff.

  Attracts talent; no disclosure of effectiveness, retention rates, or diversity outcomes.
• Remote Work Infrastructure

  Majority of workforce operates remotely part- or full-time.

  Flexible work arrangements; cited as creating cybersecurity risks and data accessibility concerns.

Criticisms on file

• Dual-Class Share Structure

  Source: DOCS_10k.txt, Risk Factors Summary: 'The dual class structure of our common stock has the effect of concentrating voting control with our executive officers (including our Chief Executive Officer) and directors and their affiliates; this will limit or preclude your ability to influence corporate matters.'
• Regulatory Exposure: HIPAA, Privacy & Data Protection

  Source: DOCS_10k.txt, Risk Factors: 'As a Business Associate under HIPAA, we face significant penalties for compliance failures, including civil monetary penalties, criminal penalties, and imprisonment. The OCR and DOJ may enforce HIPAA requirements, and state attorneys general can prosecute violations affecting their residents.'
• Regulatory Exposure: TCPA Liability

  Source: DOCS_10k.txt, Risk Factors: 'For violations of the TCPA, the law provides for a private right of action under which a plaintiff may recover statutory damages of $500 for each call, text message, or facsimile made in violation of the statute's prohibitions. A court also may treble the amount of damages upon a finding of a willful or knowing violation of the statute. There is no statutory cap on maximum aggregate exposure.'
• Regulatory Exposure: AI Governance & Evolving Legal Framework

  Source: DOCS_10k.txt, Risk Factors: 'Several jurisdictions globally have proposed or enacted laws governing AI development and use, which may increase compliance costs, trigger regulatory actions, or require business practice changes. AI models may contain inaccuracies or biases that could adversely impact individuals' rights or access to services.'
• Regulatory Exposure: Section 230 CDA Amendments Risk

  Source: DOCS_10k.txt, Risk Factors: 'In the United States, government authorities, elected officials, and political candidates have called for amendments to Section 230 of the CDA that would purport to limit or remove protections afforded to interactive computer service providers and our current protections from liability for third-party content in the United States could decrease or change.'

Disclosed initiatives

• Privacy & Data Protection Compliance Framework

  Company implements systems and procedures to comply with HIPAA, CCPA/CPRA, FTC consent decrees, state medical privacy laws, and evolving AI/consumer-protection regulations. Invests in security measures, vendor oversight, and internal controls.

  Compliance costs increasing; no quantified investment or breach history disclosed.
• Cybersecurity & Data Protection Measures

  Recovery systems, security protocols, network protection mechanisms, and physical facility safeguards designed to prevent and detect security breaches. Third-party vendor management and subprocessor audits.

  Mitigation of data breach risk; no independent third-party audit or certification disclosed.
• AI Governance & Risk Management

  Company developing policies, procedures, safeguards, and oversight mechanisms for responsible AI deployment in products and internal operations. Acknowledges risks of model inaccuracy, bias, intellectual property infringement, and regulatory non-compliance.

  Intended to reduce AI-related harms; governance framework details not disclosed.