Privacy & HIPAA

Effective date: October 29, 2026. Last updated: October 29, 2026.

Website privacy

Our online forms aren't open yet, so we don't currently collect personal data through this website. When they open, we'll collect the information you submit (name, contact details, organization details, and for applicants, resumes) only to respond to inquiries and to recruit. We don't sell personal data. We process this information to respond to your request and take steps before a contract (RA 10173, Sec. 12(b)), and for our legitimate interest in running and marketing our business (Sec. 12(f)); applicant information is processed to evaluate your application. Under the Data Privacy Act you have the right to be informed, to access, to correct, to object, to have your data erased or blocked, to data portability, and to claim damages. To exercise these rights, contact our Data Protection Officer: Michael John Vergara (michael@vaseaph.com). If you're not satisfied with our response, you may complain to the National Privacy Commission (privacy.gov.ph).

Business contacts we reach out to

Business contacts we reach out to. To introduce our services to US healthcare organizations (such as home care agencies, dental offices and medical practices), we collect business contact details that are publicly available: the business name, address, website, main phone, published business email, and the name of an owner or administrator, from the business's own website, the federal NPI Registry (organization records) and state business registries. We use them only to send a small number of business emails and make a small number of business calls, based on our legitimate interest in marketing our services (RA 10173, Sec. 12(f)). We don't collect personal phone numbers, home addresses or sensitive information, and we don't sell or share this data. We may also call the published business phone numbers on these lists, one person dialing by hand, on weekdays during business hours in your local time and always within the calling hours your state allows. We never send texts, use autodialers or play prerecorded messages to these numbers. If you'd rather we didn't call, just tell us on the call or email us, and we'll stop calling and add you to our internal do-not-call list. Where a client is not covered by HIPAA, we protect its information under a confidentiality agreement instead of a BAA. We delete contacts who don't respond within 12 months. If you ask us to stop, we keep only the minimum needed to honor that request, which is your email address on our do-not-contact list and, if we called you, your business phone number on our internal do-not-call list, so we never email or call you again. To opt out or exercise your rights (access, correction, objection, erasure), reply to our email or contact our Data Protection Officer at michael@vaseaph.com. You may also complain to the National Privacy Commission (privacy.gov.ph).

Applicant data is handled in line with the Philippine Data Privacy Act of 2012 (RA 10173). We keep applicant data for 6 months after a final decision, then delete it. If you chose to join our talent pool, we keep your profile for 12 months from your consent; we'll ask before renewing, and you can withdraw any time. Records of contractors on a project are kept as stated in their agreement.

Service providers and transfers abroad. We may use service providers such as Zoho (CRM, scheduling, e-signature and, later, calling), Google Workspace (email, documents and video calls) and Clockify (contractor time records, with no client or patient information). We'll update this notice to list the providers we actually use. Zoho processes personal data only on our instructions under its Data Processing Agreement. If we use Zoho, our account will be hosted in Zoho's United States data center, so your data would be transferred outside the Philippines. VASEA remains responsible for your data under the Data Privacy Act (RA 10173, Sec. 21) and uses contractual and security safeguards to protect it. Please do not enter patient or health information in our forms, booking pages or calls. Calls may be recorded and transcribed, including by an AI note-taking tool whose providers may be outside the Philippines, for quality and staff training purposes, only if everyone on the call agrees at the start; if anyone declines, we don't record.

Client and prospect inquiries. We keep lead records in our CRM for 12 months after our last contact, then delete them unless you become a client. Discovery calls are recorded only with everyone's consent; recordings and any AI-generated transcripts are kept for 90 days, then deleted.

Former clients. If a client account is terminated for non-payment, we keep the company name and the reason (non-payment) for 5 years to decide on future service requests. This record is internal, access-restricted and never shared.

HIPAA safeguards

• All VAs must complete HIPAA training before client work.
• VASEA signs a Business Associate Agreement (BAA) with clients when a VA will access PHI.
• VAs work in the client's own systems with individual logins, MFA and least-privilege access.
• No PHI is stored on personal devices or downloaded locally.
• All VAs must provide an NBI clearance.

Offshore restrictions

Some states and managed-care contracts restrict offshore access to Medicaid data or systems. We review this with each client before any PHI access, and offer non-PHI support where restrictions apply.

Our forms

Please don't submit patient information through this website.

Email

If we send marketing emails, they will follow the CAN-SPAM Act (15 U.S.C. 7704) and include a working unsubscribe option and our postal address.