Arami Law: Your Bridge to the US Market

Specializing in US Market Entry, Privacy & HIPAA Compliance, and Commercial Contracts for international companies.

Who I Help

I work with companies from Asia and Europe entering the US market. Whether you're navigating HIPAA compliance, responding to enterprise security questionnaires, or drafting US law contracts, I provide the legal guidance you need in your language.

Why Work With Me

In-House Experience

Years of experience as in-house counsel for multi-national corporations. I understand what your legal needs.

Privacy & Compliance Expertise

Deep focus on HIPAA, state privacy laws, data protection, and third-party risk management.

Trilingual Support

Native-level Cantonese and Mandarin. Clear communication with your team in Asia.

Author & Subject Matter Expert

Author of the forthcoming book, The Vendor Privacy Playbook.

Legal Abstract

Services

01

US Market Entry & Regulatory Analysis

For: Foreign companies figuring out which US laws apply to their business. Before you can comply, you need to know what you're dealing with. I analyze your business model, data flows, and target customers to identify which federal and state laws apply, and where your gaps are. Includes: Business model review, regulatory applicability assessment (privacy, healthcare, marketing, employment), data flow analysis, compliance gap identification, and prioritized roadmap.

02

HIPAA & Healthcare Compliance

For: Companies handling protected health information or selling to US healthcare organizations. US healthcare has strict data protection requirements that go beyond standard privacy law. I help you understand your HIPAA obligations and build the compliance foundation hospitals expect to see. Includes: HIPAA applicability assessments, Business Associate Agreement review, privacy and security policy development, healthcare vendor questionnaire support, and compliance gap analysis.

03

Vendor Risk & TPRM

For: Companies facing security questionnaires or building their own vendor management programs. US enterprise customers and hospitals will assess your security and privacy posture before signing. I help you respond confidently to questionnaires and build the documentation they expect to see. Includes: Security questionnaire response support, vendor due diligence documentation, third-party risk assessment frameworks, subprocessor management, and privacy policy review for vendor readiness.

04

Commercial Contracts

For: Any company needing US-law commercial agreements. Your US customers will expect contracts governed by US law. I draft and negotiate agreements that protect your interests while meeting market expectations. Includes: SaaS and software licensing agreements, Master Service Agreements, Business Associate Agreements, NDAs, vendor and customer contracts, and terms of service.

05

Advertising & Marketing Compliance

For: Companies marketing to US consumers via email, phone, text, or digital ads. US marketing laws carry serious penalties, including class action lawsuits and per-message fines. I help you build compliant outreach from day one. Includes: TCPA compliance (calls, texts, auto-dialers), CAN-SPAM Act (email marketing), state mini-TCPA laws, FTC advertising guidelines, cookie consent and tracking requirements, and marketing vendor agreements.

06

US State Privacy Compliance

For: Companies collecting personal data from US consumers across multiple states. The US has no single federal privacy law. Instead, you face a patchwork of state laws with different rules, definitions, and requirements. I help you understand which laws apply and what you need to do. Includes: Data flow mapping and analysis, state privacy law applicability (CCPA/CPRA, Washington MHMD, Virginia, Colorado, etc.), consumer rights compliance, privacy policy review, and compliance roadmap development.

07

App & Product Privacy

For: Companies launching mobile apps or digital products for US users. Getting approved by Apple and Google, and staying compliant, requires more than a privacy policy template. I help you build privacy into your product from the start. Includes: App Store and Google Play compliance, privacy policy drafting and review, consent flows and user permissions, children's privacy (COPPA), in-app data collection practices, and App Store rejection response support.

08

HR Policies & Workplace Compliance

For: Companies hiring employees in the United States. When you hire US workers, you need compliant policies in place. I help you build the HR foundation, including handbooks, policies, and procedures, that meet federal requirements and protect your company. Includes: Employee handbook drafting, workplace privacy policies, remote work policies, confidentiality and IP assignment agreements, acceptable use of AI policies, employee monitoring policies, and federal employment law compliance.

Other Services

In addition to my core practice areas, I also assist with:

Immigration

Green card petitions, I-9 compliance, and corporate immigration programs.

AI Governance & Policies

AI acceptable use policies, AI risk frameworks, and AI vendor assessment.

Intellectual Property

Trade secrets, copyright, trademark, licensing agreements, and IP assignments.

Outside General Counsel

Ongoing US legal support for companies without in-house counsel. Contracts, compliance, and day-to-day legal questions.

Outsourced Privacy Officer

Serve as your outsourced Data Protection Officer or HIPAA Privacy Officer on a fractional basis.

Corporate Governance

Bylaws, board resolutions, meeting minutes, and corporate maintenance.

Practice Areas

Beyond our flagship US-market-entry work, Arami Law advises across a broad range of U.S. federal and Washington State matters.

U.S. Federal Law

Immigration & Nationality

Visas, green cards, citizenship, employment & business immigration.

Intellectual Property

Copyright, trademarks, patents, trade secrets, licensing.

Privacy & Data Protection

HIPAA, COPPA, GLBA, FERPA, and FTC privacy & data-security matters.

Healthcare

HIPAA, Medicare/Medicaid, telehealth, digital health, fraud-and-abuse, FDA-regulated products.

Employment & Labor

Title VII, ADA, ADEA, FLSA, FMLA, federal discrimination and wage/hour matters.

Consumer Protection

FTC Act, advertising, endorsements, subscriptions/negative-option, e-commerce.

Cybersecurity

Federal cybersecurity and data-security requirements, incident response, sector rules.

Technology & Internet Law

Platform/e-commerce, electronic signatures and transactions, online content.

Antitrust & Competition

Sherman Act, Clayton Act, FTC Act.

Government Contracts

Federal procurement, contracting and compliance.

International Trade

Imports/exports, customs, sanctions, export controls, CFIUS and related matters.

Communications & Telecom

FCC regulation, telecommunications and digital communications matters.

Accessibility

ADA accessibility, including business and digital-accessibility matters.

Washington State Law

Business & Commercial Law

Contracts, vendor/customer agreements, business disputes, commercial transactions.

Washington Employment Law

Non-competes, confidentiality agreements, employee policies, wage/hour compliance.

Washington Consumer Protection

Washington Consumer Protection Act (CPA), unfair/deceptive practices, disclosures.

Washington Privacy & Data Law

My Health My Data Act, biometric/data issues, breach notification, sector requirements.

Business Formation & Corporate Governance

LLC/corporation formation, operating agreements, shareholder agreements, governance.

Technology & SaaS Transactions

Software licensing, SaaS agreements, technology services and data-related contracting.

Healthcare & Digital Health Law

Washington healthcare/privacy requirements affecting health-tech and health data.

Trade Secrets & Restrictive Covenants

Trade-secret protection, confidentiality, non-solicitation and non-compete issues.

Meet the Attorney

Corina De Los Santos

Corina Kwok De Los Santos

Corina is the founder and principal Attorney of Arami Law. She serves as outside counsel to companies entering the US market, particularly in the healthcare, tech and SaaS sectors. With over a decade of experience, Corina specializes in navigating regulatory environments, ensuring HIPAA compliance, privacy compliance and negotiating commercial agreements.

Prior to founding Arami Law, Corina served as in-house counsel for major robotic, automation and digital health technology firms, where she built compliance programs from the ground up and managed third-party risk for enterprise. Her unique background allows her to provide practical, business-focused legal advice that aligns with your company's growth objectives.

Corina is fluent in English, Cantonese, and Mandarin, making her a trusted partner for international companies bridging the gap between Asia and the US.

Education & Credentials

University of Washington

LL.M — University of Washington

U.S. law and regulatory systems, including privacy law, data protection, intellectual property, FDA and commercial law

University of London

LL.B — University of London

Contract law, commercial law and legal reasoning

University of Bradford

BSc Business Management — University of Bradford

Business operations, risk management, and organizational strategy

Admissions & Certifications

Washington State Bar

Bar Admission: Washington State

Licensed to practice law in Washington State

CIPP/US Certification

CIPP/US Certification

Certified Information Privacy Professional - United States

CIPP/C Certification

CIPP/C Certification

Certified Information Privacy Professional - Canada

"Practical legal guidance for companies expanding into the US market."

The Book

The Vendor Privacy Playbook: Building Third-Party Programs That Actually Work, by Corina Kwok de los Santos
Status: Coming Soon

The Vendor Privacy Playbook

Most vendor privacy assessment is broken. Generic questionnaires, scattered documentation, and security frameworks that miss what matters for privacy compliance.

The Vendor Privacy Playbook provides a different approach, the first comprehensive guide specifically for privacy professionals managing vendor risk under GDPR, CCPA, HIPAA, and emerging regulations.

You'll learn how to:

  • Design privacy-focused risk assessment methodologies
  • Build context-aware risk libraries for different data types and jurisdictions
  • Validate vendor claims with evidence, not blind trust
  • Embed privacy protections into vendor contracts
  • Implement proportional ongoing monitoring
  • Prepare for regulatory examinations

Whether building a new TPRM program or improving an existing one, you'll get practical frameworks, real-world examples, and implementation tools for organizations of any size.

Get Notified When It Launches

Join the list for launch notification and exclusive resources.

Frequently Asked Questions

We are a foreign company planning to do business in the U.S. Where do we start?+

Entering the U.S. market can involve both federal and state legal requirements. Arami Law can conduct an initial U.S. market-entry assessment to identify the legal and regulatory issues relevant to your business, product, customers, and planned operations. Depending on your business, this may include:

  • Corporate formation and governance
  • Commercial and technology contracts
  • Privacy and data protection
  • Healthcare and digital health regulation
  • Intellectual property
  • Marketing and consumer protection
  • Third-party and vendor risk
  • Employment and immigration considerations
  • Industry-specific federal requirements
  • Applicable state laws

We can then help prioritize what needs to be addressed before launch and what can be managed as your U.S. operations grow.

Can we sell products or services in the U.S. without forming a U.S. company?+

Potentially. A foreign company does not necessarily need to establish a U.S. entity simply because it has U.S. customers. The appropriate structure depends on how you plan to operate, including where your customers and employees are located, whether you will have a physical U.S. presence, how contracts will be entered into, and the regulatory requirements applicable to your business. Arami Law can advise on the U.S. legal and operational considerations and coordinate with tax, accounting, and other specialists where additional advice is required.

Which U.S. laws apply to us if our company is based outside the United States?+

Being incorporated outside the United States does not necessarily mean U.S. law will not apply. Depending on your activities, U.S. requirements may arise from:

  • Federal laws and regulations
  • State privacy and consumer protection laws
  • Healthcare and health-data laws
  • Advertising and marketing requirements
  • Intellectual property laws
  • Contractual obligations imposed by U.S. customers
  • Industry-specific regulations

We help international companies determine which requirements actually apply to their U.S. activities, rather than approaching U.S. compliance as a one-size-fits-all exercise.

Do U.S. privacy laws apply to foreign companies?+

They can. U.S. privacy regulation includes a combination of federal, state, and sector-specific laws, and certain requirements may apply to companies outside the United States when they collect, use, share, or process information relating to U.S. consumers. Arami Law advises international companies on matters including:

  • U.S. state privacy laws
  • Consumer health data
  • HIPAA and healthcare privacy
  • Website and mobile-app privacy
  • Cookies and tracking technologies
  • Privacy notices and consent requirements
  • Consumer privacy rights
  • Data processing and sharing arrangements
  • Cross-border data flows
  • Privacy impact assessments
  • Vendor and third-party privacy requirements

We can assess your existing global privacy program and determine what needs to be adapted for U.S. operations.

We don't have a U.S. privacy team. Can Arami Law manage our U.S. privacy compliance?+

Yes. Arami Law can serve as an Outsourced Privacy Officer or Fractional Privacy Counsel for international businesses that need ongoing U.S. privacy support without building a full internal U.S. privacy legal function. Depending on your needs, we can provide ongoing advice, maintain and develop privacy policies and procedures, review new products and data uses, conduct privacy assessments, advise on vendor and contractual issues, support consumer-rights processes, assist with privacy incidents, and work with your legal, security, product, and business teams. The scope can grow with your U.S. operations.

Our U.S. customer sent us a privacy or security questionnaire. Can Arami Law help?+

Yes. Privacy, cybersecurity, and vendor assessments are increasingly part of doing business with U.S. customers, particularly in healthcare, technology, and other data-intensive industries. We can review the customer's requirements, help your team respond to legal and privacy questions, identify compliance gaps, review supporting policies and documentation, and advise on contractual commitments arising from the assessment. Where technical security validation is required, we can work alongside your information-security or technical advisers.

A U.S. customer says we need to be HIPAA compliant. Does HIPAA actually apply to us?+

Not necessarily. Whether HIPAA applies depends on factors such as who your U.S. customers are, what services you provide, what health information you receive or process, and your relationship with covered entities and business associates. Before undertaking a large HIPAA compliance project, Arami Law can assess your business model, product, data flows, and contractual relationships to determine whether HIPAA applies and, if so, what role your company has and what compliance obligations follow. We can also assist with HIPAA readiness, Business Associate Agreements (BAAs), policies and procedures, customer requirements, vendor arrangements, and ongoing healthcare privacy matters.

Can Arami Law negotiate contracts with our U.S. customers, vendors, and business partners?+

Yes. We advise international businesses on U.S. commercial and technology transactions, including:

  • Customer and vendor agreements
  • SaaS and software agreements
  • Licensing agreements
  • Data processing and data-sharing agreements
  • Privacy and security terms
  • Business Associate Agreements
  • Confidentiality agreements
  • Technology and services agreements
  • Partnership and commercial arrangements

We can also help adapt existing international contract templates for use with U.S. customers and counterparties.

How can we protect our intellectual property in the United States?+

Intellectual property protection should be considered early when entering the U.S. market. Arami Law can assist with matters involving trademarks, copyright, software and content ownership, licensing, IP provisions in commercial agreements, confidentiality, and protection of proprietary business information. For specialized patent matters or other matters requiring additional technical expertise, we can coordinate with appropriate counsel where needed.

Can you help our founders, executives, or employees relocate to the United States?+

Depending on the circumstances, U.S. immigration options may be available for founders, investors, executives, specialized employees, and other professionals. Arami Law can advise on appropriate immigration pathways and the relationship between immigration planning and the company's broader U.S. market-entry strategy.

Can Arami Law continue advising us after we enter the U.S. market?+

Yes. Many international businesses do not initially need a full internal U.S. legal department. Arami Law can provide ongoing outside U.S. legal counsel, including commercial contracting, privacy and data protection, healthcare and digital health matters, regulatory questions, intellectual property, vendor issues, and day-to-day legal support. For businesses with significant privacy needs, we can also provide ongoing Outsourced Privacy Officer or Fractional Privacy Counsel services. This allows your U.S. legal support to scale as your business grows.

Contact

Get in Touch

Ready to discuss your US legal needs? I work with clients across time zones and communicate in English, Cantonese, and Mandarin.

Send a Message

By submitting this form, you acknowledge that Arami Law is collecting your information solely for the purpose of evaluating a potential attorney-client relationship. Submitting this form does not create an attorney-client relationship.

Subscribe to Our Newsletter

Stay updated with the latest legal insights, blog posts, and news from Arami Law.