Arami Law: Your Bridge to the US Market
Who I Help
I work with companies from Asia and Europe entering the US market. Whether you're navigating HIPAA compliance, responding to enterprise security questionnaires, or drafting US law contracts, I provide the legal guidance you need in your language.
Why Work With Me
In-House Experience
Years of experience as in-house counsel for multi-national corporations. I understand what your legal needs.
Privacy & Compliance Expertise
Deep focus on HIPAA, state privacy laws, data protection, and third-party risk management.
Trilingual Support
Native-level Cantonese and Mandarin. Clear communication with your team in Asia.
Author & Subject Matter Expert
Author of the forthcoming book, The Vendor Privacy Playbook.

Services
US Market Entry & Regulatory Analysis
For: Foreign companies figuring out which US laws apply to their business. Before you can comply, you need to know what you're dealing with. I analyze your business model, data flows, and target customers to identify which federal and state laws apply, and where your gaps are. Includes: Business model review, regulatory applicability assessment (privacy, healthcare, marketing, employment), data flow analysis, compliance gap identification, and prioritized roadmap.
HIPAA & Healthcare Compliance
For: Companies handling protected health information or selling to US healthcare organizations. US healthcare has strict data protection requirements that go beyond standard privacy law. I help you understand your HIPAA obligations and build the compliance foundation hospitals expect to see. Includes: HIPAA applicability assessments, Business Associate Agreement review, privacy and security policy development, healthcare vendor questionnaire support, and compliance gap analysis.
Vendor Risk & TPRM
For: Companies facing security questionnaires or building their own vendor management programs. US enterprise customers and hospitals will assess your security and privacy posture before signing. I help you respond confidently to questionnaires and build the documentation they expect to see. Includes: Security questionnaire response support, vendor due diligence documentation, third-party risk assessment frameworks, subprocessor management, and privacy policy review for vendor readiness.
Commercial Contracts
For: Any company needing US-law commercial agreements. Your US customers will expect contracts governed by US law. I draft and negotiate agreements that protect your interests while meeting market expectations. Includes: SaaS and software licensing agreements, Master Service Agreements, Business Associate Agreements, NDAs, vendor and customer contracts, and terms of service.
Advertising & Marketing Compliance
For: Companies marketing to US consumers via email, phone, text, or digital ads. US marketing laws carry serious penalties, including class action lawsuits and per-message fines. I help you build compliant outreach from day one. Includes: TCPA compliance (calls, texts, auto-dialers), CAN-SPAM Act (email marketing), state mini-TCPA laws, FTC advertising guidelines, cookie consent and tracking requirements, and marketing vendor agreements.
US State Privacy Compliance
For: Companies collecting personal data from US consumers across multiple states. The US has no single federal privacy law. Instead, you face a patchwork of state laws with different rules, definitions, and requirements. I help you understand which laws apply and what you need to do. Includes: Data flow mapping and analysis, state privacy law applicability (CCPA/CPRA, Washington MHMD, Virginia, Colorado, etc.), consumer rights compliance, privacy policy review, and compliance roadmap development.
App & Product Privacy
For: Companies launching mobile apps or digital products for US users. Getting approved by Apple and Google, and staying compliant, requires more than a privacy policy template. I help you build privacy into your product from the start. Includes: App Store and Google Play compliance, privacy policy drafting and review, consent flows and user permissions, children's privacy (COPPA), in-app data collection practices, and App Store rejection response support.
HR Policies & Workplace Compliance
For: Companies hiring employees in the United States. When you hire US workers, you need compliant policies in place. I help you build the HR foundation, including handbooks, policies, and procedures, that meet federal requirements and protect your company. Includes: Employee handbook drafting, workplace privacy policies, remote work policies, confidentiality and IP assignment agreements, acceptable use of AI policies, employee monitoring policies, and federal employment law compliance.
Other Services
In addition to my core practice areas, I also assist with:
Immigration
Green card petitions, I-9 compliance, and corporate immigration programs.
AI Governance & Policies
AI acceptable use policies, AI risk frameworks, and AI vendor assessment.
Intellectual Property
Trade secrets, copyright, trademark, licensing agreements, and IP assignments.
Outside General Counsel
Ongoing US legal support for companies without in-house counsel. Contracts, compliance, and day-to-day legal questions.
Outsourced Privacy Officer
Serve as your outsourced Data Protection Officer or HIPAA Privacy Officer on a fractional basis.
Corporate Governance
Bylaws, board resolutions, meeting minutes, and corporate maintenance.
Practice Areas
Beyond our flagship US-market-entry work, Arami Law advises across a broad range of U.S. federal and Washington State matters.
U.S. Federal Law
Immigration & Nationality
Visas, green cards, citizenship, employment & business immigration.
Intellectual Property
Copyright, trademarks, patents, trade secrets, licensing.
Privacy & Data Protection
HIPAA, COPPA, GLBA, FERPA, and FTC privacy & data-security matters.
Healthcare
HIPAA, Medicare/Medicaid, telehealth, digital health, fraud-and-abuse, FDA-regulated products.
Employment & Labor
Title VII, ADA, ADEA, FLSA, FMLA, federal discrimination and wage/hour matters.
Consumer Protection
FTC Act, advertising, endorsements, subscriptions/negative-option, e-commerce.
Cybersecurity
Federal cybersecurity and data-security requirements, incident response, sector rules.
Technology & Internet Law
Platform/e-commerce, electronic signatures and transactions, online content.
Antitrust & Competition
Sherman Act, Clayton Act, FTC Act.
Government Contracts
Federal procurement, contracting and compliance.
International Trade
Imports/exports, customs, sanctions, export controls, CFIUS and related matters.
Communications & Telecom
FCC regulation, telecommunications and digital communications matters.
Accessibility
ADA accessibility, including business and digital-accessibility matters.
Washington State Law
Business & Commercial Law
Contracts, vendor/customer agreements, business disputes, commercial transactions.
Washington Employment Law
Non-competes, confidentiality agreements, employee policies, wage/hour compliance.
Washington Consumer Protection
Washington Consumer Protection Act (CPA), unfair/deceptive practices, disclosures.
Washington Privacy & Data Law
My Health My Data Act, biometric/data issues, breach notification, sector requirements.
Business Formation & Corporate Governance
LLC/corporation formation, operating agreements, shareholder agreements, governance.
Technology & SaaS Transactions
Software licensing, SaaS agreements, technology services and data-related contracting.
Healthcare & Digital Health Law
Washington healthcare/privacy requirements affecting health-tech and health data.
Trade Secrets & Restrictive Covenants
Trade-secret protection, confidentiality, non-solicitation and non-compete issues.
Meet the Attorney

Corina Kwok De Los Santos
Corina is the founder and principal Attorney of Arami Law. She serves as outside counsel to companies entering the US market, particularly in the healthcare, tech and SaaS sectors. With over a decade of experience, Corina specializes in navigating regulatory environments, ensuring HIPAA compliance, privacy compliance and negotiating commercial agreements.
Prior to founding Arami Law, Corina served as in-house counsel for major robotic, automation and digital health technology firms, where she built compliance programs from the ground up and managed third-party risk for enterprise. Her unique background allows her to provide practical, business-focused legal advice that aligns with your company's growth objectives.
Corina is fluent in English, Cantonese, and Mandarin, making her a trusted partner for international companies bridging the gap between Asia and the US.
Education & Credentials

LL.M — University of Washington
U.S. law and regulatory systems, including privacy law, data protection, intellectual property, FDA and commercial law

LL.B — University of London
Contract law, commercial law and legal reasoning

BSc Business Management — University of Bradford
Business operations, risk management, and organizational strategy
Admissions & Certifications

Bar Admission: Washington State
Licensed to practice law in Washington State

CIPP/US Certification
Certified Information Privacy Professional - United States

CIPP/C Certification
Certified Information Privacy Professional - Canada
"Practical legal guidance for companies expanding into the US market."
The Book

The Vendor Privacy Playbook
Most vendor privacy assessment is broken. Generic questionnaires, scattered documentation, and security frameworks that miss what matters for privacy compliance.
The Vendor Privacy Playbook provides a different approach, the first comprehensive guide specifically for privacy professionals managing vendor risk under GDPR, CCPA, HIPAA, and emerging regulations.
You'll learn how to:
- Design privacy-focused risk assessment methodologies
- Build context-aware risk libraries for different data types and jurisdictions
- Validate vendor claims with evidence, not blind trust
- Embed privacy protections into vendor contracts
- Implement proportional ongoing monitoring
- Prepare for regulatory examinations
Whether building a new TPRM program or improving an existing one, you'll get practical frameworks, real-world examples, and implementation tools for organizations of any size.
Get Notified When It Launches
Join the list for launch notification and exclusive resources.
Frequently Asked Questions
We are a foreign company planning to do business in the U.S. Where do we start?+
Entering the U.S. market can involve both federal and state legal requirements. Arami Law can conduct an initial U.S. market-entry assessment to identify the legal and regulatory issues relevant to your business, product, customers, and planned operations. Depending on your business, this may include:
- Corporate formation and governance
- Commercial and technology contracts
- Privacy and data protection
- Healthcare and digital health regulation
- Intellectual property
- Marketing and consumer protection
- Third-party and vendor risk
- Employment and immigration considerations
- Industry-specific federal requirements
- Applicable state laws
We can then help prioritize what needs to be addressed before launch and what can be managed as your U.S. operations grow.
Can we sell products or services in the U.S. without forming a U.S. company?+
Potentially. A foreign company does not necessarily need to establish a U.S. entity simply because it has U.S. customers. The appropriate structure depends on how you plan to operate, including where your customers and employees are located, whether you will have a physical U.S. presence, how contracts will be entered into, and the regulatory requirements applicable to your business. Arami Law can advise on the U.S. legal and operational considerations and coordinate with tax, accounting, and other specialists where additional advice is required.
Which U.S. laws apply to us if our company is based outside the United States?+
Being incorporated outside the United States does not necessarily mean U.S. law will not apply. Depending on your activities, U.S. requirements may arise from:
- Federal laws and regulations
- State privacy and consumer protection laws
- Healthcare and health-data laws
- Advertising and marketing requirements
- Intellectual property laws
- Contractual obligations imposed by U.S. customers
- Industry-specific regulations
We help international companies determine which requirements actually apply to their U.S. activities, rather than approaching U.S. compliance as a one-size-fits-all exercise.
Do U.S. privacy laws apply to foreign companies?+
They can. U.S. privacy regulation includes a combination of federal, state, and sector-specific laws, and certain requirements may apply to companies outside the United States when they collect, use, share, or process information relating to U.S. consumers. Arami Law advises international companies on matters including:
- U.S. state privacy laws
- Consumer health data
- HIPAA and healthcare privacy
- Website and mobile-app privacy
- Cookies and tracking technologies
- Privacy notices and consent requirements
- Consumer privacy rights
- Data processing and sharing arrangements
- Cross-border data flows
- Privacy impact assessments
- Vendor and third-party privacy requirements
We can assess your existing global privacy program and determine what needs to be adapted for U.S. operations.
We don't have a U.S. privacy team. Can Arami Law manage our U.S. privacy compliance?+
Yes. Arami Law can serve as an Outsourced Privacy Officer or Fractional Privacy Counsel for international businesses that need ongoing U.S. privacy support without building a full internal U.S. privacy legal function. Depending on your needs, we can provide ongoing advice, maintain and develop privacy policies and procedures, review new products and data uses, conduct privacy assessments, advise on vendor and contractual issues, support consumer-rights processes, assist with privacy incidents, and work with your legal, security, product, and business teams. The scope can grow with your U.S. operations.
Our U.S. customer sent us a privacy or security questionnaire. Can Arami Law help?+
Yes. Privacy, cybersecurity, and vendor assessments are increasingly part of doing business with U.S. customers, particularly in healthcare, technology, and other data-intensive industries. We can review the customer's requirements, help your team respond to legal and privacy questions, identify compliance gaps, review supporting policies and documentation, and advise on contractual commitments arising from the assessment. Where technical security validation is required, we can work alongside your information-security or technical advisers.
A U.S. customer says we need to be HIPAA compliant. Does HIPAA actually apply to us?+
Not necessarily. Whether HIPAA applies depends on factors such as who your U.S. customers are, what services you provide, what health information you receive or process, and your relationship with covered entities and business associates. Before undertaking a large HIPAA compliance project, Arami Law can assess your business model, product, data flows, and contractual relationships to determine whether HIPAA applies and, if so, what role your company has and what compliance obligations follow. We can also assist with HIPAA readiness, Business Associate Agreements (BAAs), policies and procedures, customer requirements, vendor arrangements, and ongoing healthcare privacy matters.
Can Arami Law negotiate contracts with our U.S. customers, vendors, and business partners?+
Yes. We advise international businesses on U.S. commercial and technology transactions, including:
- Customer and vendor agreements
- SaaS and software agreements
- Licensing agreements
- Data processing and data-sharing agreements
- Privacy and security terms
- Business Associate Agreements
- Confidentiality agreements
- Technology and services agreements
- Partnership and commercial arrangements
We can also help adapt existing international contract templates for use with U.S. customers and counterparties.
How can we protect our intellectual property in the United States?+
Intellectual property protection should be considered early when entering the U.S. market. Arami Law can assist with matters involving trademarks, copyright, software and content ownership, licensing, IP provisions in commercial agreements, confidentiality, and protection of proprietary business information. For specialized patent matters or other matters requiring additional technical expertise, we can coordinate with appropriate counsel where needed.
Can you help our founders, executives, or employees relocate to the United States?+
Depending on the circumstances, U.S. immigration options may be available for founders, investors, executives, specialized employees, and other professionals. Arami Law can advise on appropriate immigration pathways and the relationship between immigration planning and the company's broader U.S. market-entry strategy.
Can Arami Law continue advising us after we enter the U.S. market?+
Yes. Many international businesses do not initially need a full internal U.S. legal department. Arami Law can provide ongoing outside U.S. legal counsel, including commercial contracting, privacy and data protection, healthcare and digital health matters, regulatory questions, intellectual property, vendor issues, and day-to-day legal support. For businesses with significant privacy needs, we can also provide ongoing Outsourced Privacy Officer or Fractional Privacy Counsel services. This allows your U.S. legal support to scale as your business grows.
Contact
Get in Touch
Ready to discuss your US legal needs? I work with clients across time zones and communicate in English, Cantonese, and Mandarin.
Send a Message
Subscribe to Our Newsletter
Stay updated with the latest legal insights, blog posts, and news from Arami Law.