Privacy & HIPAA

Effective date: October 29, 2026. Last updated: October 29, 2026.

Website privacy

Our online forms aren't open yet, so we don't currently collect personal data through this website. When they open, we'll collect the information you submit (name, contact details, agency details, and for applicants, resumes) only to respond to inquiries and to recruit. We don't sell personal data. We process this information to respond to your request and take steps before a contract (RA 10173, Sec. 12(b)), and for our legitimate interest in running and marketing our business (Sec. 12(f)); applicant information is processed to evaluate your application. Under the Data Privacy Act you have the right to be informed, to access, to correct, to object, to have your data erased or blocked, to data portability, and to claim damages. To exercise these rights, contact our Data Protection Officer: Michael John Vergara (contact email coming soon). If you're not satisfied with our response, you may complain to the National Privacy Commission (privacy.gov.ph).

Applicant data is handled in line with the Philippine Data Privacy Act of 2012 (RA 10173). We keep applicant data for 6 months after a final decision, then delete it. If you chose to join our talent pool, we keep your profile for 12 months from your consent; we'll ask before renewing, and you can withdraw any time. Records of contractors on a project are kept as stated in their agreement.

Service providers and transfers abroad. We may use service providers such as Zoho (CRM, scheduling, e-signature and, later, calling), Google Workspace (email, documents and video calls) and Clockify (contractor time records, with no client or patient information). We'll update this notice to list the providers we actually use. Zoho processes personal data only on our instructions under its Data Processing Agreement. If we use Zoho, our account will be hosted in Zoho's United States data center, so your data would be transferred outside the Philippines. VASEA remains responsible for your data under the Data Privacy Act (RA 10173, Sec. 21) and uses contractual and security safeguards to protect it. Please do not enter patient or health information in our forms, booking pages or calls. We record calls only if everyone on the call agrees at the start; if anyone declines, we don't record.

Client and prospect inquiries. We keep lead records in our CRM for 12 months after our last contact, then delete them unless you become a client. Discovery calls are recorded only with everyone's consent; recordings and any AI-generated transcripts are kept for 90 days, then deleted.

Former clients. If a client account is terminated for non-payment, we keep the company name and the reason (non-payment) for 5 years to decide on future service requests. This record is internal, access-restricted and never shared.

HIPAA safeguards

• All VAs must complete HIPAA training before client work.
• VASEA signs a Business Associate Agreement (BAA) with clients when a VA will access PHI.
• VAs work in the client's own systems with individual logins, MFA and least-privilege access.
• No PHI is stored on personal devices or downloaded locally.
• All VAs must provide an NBI clearance.

Offshore restrictions

Some states and managed-care contracts restrict offshore access to Medicaid data or systems. We review this with each client before any PHI access, and offer non-PHI support where restrictions apply.

Our forms

Please don't submit patient information through this website.

Email

If we send marketing emails, they will follow the CAN-SPAM Act (15 U.S.C. 7704) and include a working unsubscribe option and our postal address.