Legal Due Diligence of Healthcare Intermediary Service Platforms in Vietnam: Perspectives on Licensing, Intellectual Property, and Personal Data
I. INTRODUCTION
The market for healthcare service booking platforms in Vietnam – spanning telemedicine, appointment booking, and online health consultations – is growing rapidly, driving a wave of fundraising and mergers and acquisitions (M&A) in the health technology sector. However, unlike a typical technology start-up, legal due diligence on this group of businesses is considerably more complex, as their business models sit at the intersection of multiple areas of law: the law on medical examination and treatment, e-commerce law, intellectual property law, and personal data protection law.
This overlap means that the legal risks of a Healthcare Intermediary Service Provider are rarely concentrated in a single area, but instead spread across several layers: from correctly classifying the operating model, to ownership of intellectual property assets, to compliance with personal data protection obligations. A red flag at any one of these layers can directly affect the valuation outcome or the risk-allocation mechanism following the transaction.
This article examines three key areas that a due diligence team – investors, in-house counsel, or the start-up itself ahead of a fundraising round – should scrutinize closely: (i) licensing and compliance with industry-specific regulations; (ii) intellectual property; and (iii) personal data.
II. LICENSING AND INDUSTRY-SPECIFIC REGULATORY COMPLIANCE
For a Healthcare Intermediary Service Platform, licensing due diligence must be based on the Platform’s entire service delivery process in practice. The same application may simultaneously operate as an e-commerce intermediary and as a provider of professional healthcare services, with each role triggering a different set of business conditions and notification, registration or licensing procedures. The central question is therefore what the company, doctors and healthcare establishments actually do, in whose name they act, and under what mechanism they bear responsibility to service users.
2.1. Classification of the model – an intermediary platform or a healthcare service provider?
Classifying a model as an intermediary platform or a healthcare service provider plays an important role in determining the applicable legal requirements, including registered business lines, required licences and legal procedures to be completed.
A pure intermediary model is generally limited to allowing users to search for and compare information, select a medical examination and treatment establishment or practitioner, make appointments and, where applicable, make payments through the Platform. Under this structure, the contract for the provision of medical examination and treatment services, patient intake, professional decisions and responsibility for medical examination and treatment outcomes remain, in principle, with the medical examination and treatment establishment and the practitioner partnering with the Platform. The Platform receives a service fee, commission or technology fee for its connecting function, rather than holding itself out as the provider of healthcare services.
By contrast, the legal boundary shifts significantly if the Platform directly collects symptoms to assess a user’s health condition, provides personalised assessments, makes diagnoses, prescribes treatment methods or medicines, creates or manages medical records, or acts in its own name to provide and charge for medical examination and treatment services. These functions may fall within the statutory concepts of “medical examination”, “medical treatment” or “remote medical examination and treatment”, regardless of whether the Platform’s interface labels them as “consultation”, “health support” or “chat with an expert”.15
The distinction between a pure intermediary platform and a platform providing medical examination and treatment services can be summarised by reference to their respective functional scopes as follows:
| Pure intermediary platform | Platform providing medical examination and treatment services |
|
|
In practice, a platform may begin as an appointment-booking tool and subsequently add functions such as symptom questionnaires, screening chatbots, electronic prescribing and health-metric monitoring. These new functions may shift the enterprise’s role from that of a technical intermediary to that of a participant in, or direct organiser of, professional healthcare activities. Accordingly, legal due diligence should simultaneously review: (i) the actual user interface and user journey on the Platform; (ii) the terms of use; (iii) contracts with hospitals, clinics and doctors; (iv) the entity issuing invoices; (v) the method of collecting and sharing service fees; (vi) the entity signing prescriptions, issuing results, retaining medical records and handling professional complaints; and (vii) the manner in which the enterprise markets the services. A general statement that the Platform “only provides technology” is insufficient to exclude liability where its actual operations indicate that the enterprise performs medical examination and treatment services.
2.2. Licences and conditions to be reviewed
Due diligence on licences and business conditions applicable to an enterprise operating a Healthcare Intermediary Service Platform should be conducted from multiple perspectives: enterprise registration, e-commerce compliance, sector-specific healthcare licences, practitioner conditions, advertising procedures and specific conditions applicable to remote medical examination and treatment. The scope of due diligence should be determined by the actual functions of each Platform.
(i) Enterprise registration and registered business lines.
First, the business lines registered with the Department of Finance should be reviewed and compared against the enterprise’s actual operations, including the manner in which it generates revenue. Depending on the model, several different business lines may be relevant.
Where acting as an intermediary platform connecting users with partners that provide medical examination and treatment services, the enterprise must register, at a minimum, business line code 8691 (86910) – Intermediation service activities for medical, dental and other healthcare services. This business line is prescribed under Decision No. 36/2025/QD-TTg dated 29 September 2025 on the Vietnam Standard Industrial Classification and covers activities connecting customers with providers of medical, dental and other healthcare services for a fee or commission where the intermediary does not itself provide the healthcare services.
Where the enterprise provides advertising services to partners on the Platform, it must additionally register the advertising business line (7310).
Where the enterprise directly provides healthcare services such as medical examination and treatment at a facility or remote medical examination and treatment, it must register all relevant business lines, including codes prescribed under Decision No. 36/2025/QD-TTg such as 8610 (Activities of hospitals and health stations) and 8620 (Activities of general, specialist and dental clinics), among others.
However, a registered business line merely reflects the scope of activities declared by the enterprise and does not replace sector-specific licences. Registration of the healthcare intermediation business line does not, by itself, authorise the enterprise to connect users with medical examination and treatment service providers or to directly provide medical examination and treatment services; conversely, registration of healthcare business lines does not cure the absence of an operating licence for the establishment or a practising licence for an individual. These legal requirements are discussed below.
(ii) Compliance with e-commerce laws
At present, the legal framework directly governing “intermediation service activities for medical, dental and other healthcare services” comprises the Law on E-Commerce 2025 and Decree No. 248/2026/ND-CP, effective from 1 July 2026. Decree No. 52/2013/ND-CP and Decree No. 85/2021/ND-CP are no longer in force. This is particularly important when reviewing dossiers prepared or confirmed before July 2026.
Where the Platform allows hospitals, clinics or independent providers to introduce services, receive appointment bookings and/or enter into transactions with users, the model may be classified as an intermediary e-commerce platform.16 The enterprise may only operate after satisfying the applicable management and operational conditions and obtaining registration confirmation from the Ministry of Industry and Trade. Due diligence should not be limited to checking the “registered with the Ministry of Industry and Trade” icon on the website; it should also verify the confirmation document, the domain name and application name covered by the confirmation, the operating model, operational plan, platform rules, contractual terms, provider verification mechanism, information disclosure, complaint-handling mechanism and transaction-data retention.17
For websites or applications confirmed under the former legal framework before 1 July 2026, the enterprise may continue operating in accordance with the confirmed contents until 30 June 2027, but must amend or supplement its dossier under Decree No. 248/2026/ND-CP during the transitional period.18 Accordingly, legal due diligence at present must assess both current compliance and the transition plan before the end of the transitional period.
(iii) Operating licence of a medical examination and treatment establishment.
Where the target company directly provides medical examination and treatment services, it must have an Operating Licence for a Medical Examination and Treatment Establishment issued by the competent authority (the Department of Health, Ministry of Health, Ministry of National Defence or Ministry of Public Security, as applicable).19
The due diligence team should review the operating licence of the medical examination and treatment establishment; its organisational form; address; working hours; scope of professional activities; list of permitted techniques; person responsible for professional and technical operations; and relevant amending decisions. Changes to the name, address or organisational form, or a division, consolidation or merger, may trigger procedures for a new licence or licence amendment. Accordingly, a licence issued before a restructuring transaction does not automatically cover all post-transaction activities.20
Even where the Platform only acts as an intermediary, the licences of partner establishments remain a material part of the due diligence dossier. The services displayed on the Platform should be cross-checked against the scope of professional activities licensed to each establishment; the location at which each service is performed should be verified against the licensed address; and the mechanism for suspending or removing a partner should be examined where its licence expires, is amended, suspended or revoked. A contractual provision requiring a partner to “bear sole responsibility for compliance” does not replace the Platform’s verification and monitoring process.
(iv) Practising licences and practice registration of doctors and healthcare personnel
Under current laws on medical examination and treatment, an individual may only conduct medical examination and treatment if they hold a valid practising licence, have registered their practice and satisfy other statutory conditions, except for certain special exemptions. Accordingly, for each doctor or healthcare professional appearing on the Platform, the due diligence team should verify the licence number, professional title, scope of practice, validity status, establishment and working hours under the practice registration, as well as any suspension or revocation.21
In practice, dossiers may use both the term “practice certificate” under the Law on Medical Examination and Treatment 2009 and the term “practising licence” under current law. Practice certificates issued before 1 January 2024 will be converted into practising licences in accordance with the roadmap prescribed by the Government.22
(v) Advertising of medical examination and treatment services
Activities introducing doctors, healthcare establishments and service packages on websites, applications or social media may constitute advertising, particularly where the content contains promotional messages, efficacy claims, quality comparisons or calls for users to book services. Under current advertising laws, advertisements for medical examination and treatment services must be based on a valid practising licence or operating licence; the advertising content must also comply with the confirmation procedure and sector-specific requirements of the Ministry of Health.23
In addition, where the target company provides drug advertising services, it must obtain a Certificate of Confirmation of Drug Advertising Contents from the Ministry of Health.24
Common red flags include advertising services outside the licensed professional scope of a medical examination and treatment establishment, and using claims such as “the best” or “definitive treatment” in drug advertisements.25 The foregoing non-compliant advertising acts are subject to penalties under Decree No. 87/2026/ND-CP.
(vi) Remote medical examination and treatment (telemedicine)
The Law on Medical Examination and Treatment 2023 and Decree No. 96/2023/ND-CP establish the legal framework for remote medical examination and treatment between a practitioner and a patient. Such activities must be performed by a practitioner of an appropriate medical examination and treatment establishment; fall within the practitioner’s scope of practice and the establishment’s scope of professional activities; be supported by sufficient personnel; and use infrastructure, equipment and software that satisfy requirements on safety, confidentiality, data retention and data backup. The establishment must submit a declaration that it satisfies the applicable conditions; where the service falls outside the permitted list of diseases and medical conditions, the establishment must apply to conduct the service on a pilot basis.26
From a due diligence perspective, it is necessary to clearly identify which entity is the establishment providing the remote service, which entity bears responsibility for diagnosis, treatment indications and prescribing, the mechanism for transferring a patient to an in-person examination, the method of collecting and sharing fees, and the location where records are retained. Where the Platform only provides technical infrastructure to a licensed establishment, the declaration obligation generally rests with the healthcare establishment; however, the Platform’s contracts and system architecture must still enable the establishment to comply with requirements on confidentiality, retention, professional responsibility and remote-support contracts.27
A significant current issue is determining the boundary between the provision of general health information and personalised consultation that constitutes medical examination and treatment; allocating responsibility where the Platform controls the intake process, pricing and data; and addressing the application of new technology models such as chatbots or AI tools, so as to identify the responsible entity and the procedures that must be completed.
2.3. Common red flags
From a legal due diligence perspective, the following risks should be noted:
(i) The registered business lines do not cover the enterprise’s actual operations and revenue sources; the enterprise has not updated the healthcare intermediation business line or relevant technology and e-commerce business lines.
(ii) The website or application allows multiple establishments or doctors to receive appointment bookings and enter into transactions, but has not obtained registration confirmation as an intermediary e-commerce platform; or the confirmation dossier under the former mechanism no longer corresponds to the current application name, functions and operating model.
(iii) The Platform claims to act only as an intermediary but directly screens symptoms, provides personalised consultation, makes diagnoses, prescribes treatment or medicines, or collects medical examination and treatment fees without a licensed medical examination and treatment establishment standing as the service provider and bearing professional responsibility.
(iv) The operating licence of a partner establishment specifies an incorrect location or does not cover the service being advertised; the establishment has not declared its eligibility to provide remote medical examination and treatment; or its licensing documents have not been updated following a restructuring, change of location or change in scope of activities.
(v) A doctor or healthcare professional does not hold a valid licence or certificate, practises outside the licensed scope, has not registered their practice at the relevant establishment, or the enterprise has no process for periodically verifying licence status.
(vi) Content on the application or website advertises services outside the licensed scope, lacks the necessary confirmation documents or uses guarantees regarding treatment outcomes, while the contract shifts all responsibility to the partner doctor or establishment even though the Platform controls the content, pricing and service sales process.
These red flags may lead to a requirement to restructure the model before the transaction, complete licensing and registration procedures as conditions precedent, include specific indemnity mechanisms or adjust the valuation. Investors should not treat a licensing deficiency as an issue that can automatically be cured after completion: in certain cases, obtaining the requisite licence requires changes to the service provider, professional personnel, technical infrastructure and the entire contractual flow with users.
III. INTELLECTUAL PROPERTY
Legal due diligence on intellectual property answers a question that lies at the heart of every M&A or fundraising transaction: does the company actually and lawfully own the intangible assets it is selling? This is often the area founders are most complacent about, and the one investors are most likely to overlook at an early stage.
3.1. Mapping the intellectual property assets of a health technology platform
Before assessing ownership, it is necessary to fully understand the range of intellectual property assets typically held by a Healthcare Intermediary Service Provider, as each category carries its own mechanism for establishing rights and its own risk profile:
- Trademarks: brand name, logo, and tagline – used to identify the service in the market.
- Copyright and related rights: software/application source code (protected as a computer program work), user interface and user experience (UI/UX), and medical content (articles, drug databases, guidance materials).
- Patents/utility solutions: technical solutions embedded in doctor-patient matching algorithms, and applications of artificial intelligence (AI) in diagnostic support or scheduling.28
- Domain names: closely tied to operations and brand value.
- Trade secrets: model training data, internal operating procedures, and algorithms that have not been registered for protection.
This is the first checklist a due diligence team should verify against the reality of the target company – many start-ups can only point to an “app” and a “logo,” while the assets that are actually driving the business (algorithms, training data) have never been identified as assets requiring protection, and the protection mechanism currently in place, if any, may not be appropriate for the nature of the asset.
3.2. Ownership of intellectual property – the foundational question
This is the highest-risk area in legal due diligence practice for health technology platforms in Vietnam, because the core question is not only what intellectual property assets the company holds, but who actually and lawfully owns them. For a technology platform, the answer begins with the employment contracts, contractor agreements, and outsourcing agreements entered into with the developers or software development vendors: do these agreements contain an assignment clause, or otherwise clearly state that copyright and industrial property rights belong to the company?
The most common risk in practice is that the product was developed by the founders themselves, or by the initial technical team, before the company was even incorporated. In such cases, as a matter of principle, ownership of the intellectual property remains with the individual until a valid assignment is executed in favour of the company after incorporation – a step that most early-stage start-ups overlook. Similarly, for products developed jointly with a technology partner or a hospital/clinic, the collaboration agreement should be reviewed to clearly determine joint or separate ownership of any resulting intellectual property.
In practical terms, if the chain of assignment – from the founders to the company, and from employees or contractors to the company – is incomplete, an investor may effectively be acquiring a business that does not actually own its own core assets. This is precisely why completing the chain of intellectual property assignment is one of the most frequently negotiated conditions precedent in health technology transactions.
3.3. Trademark registration
The absence of a registered trademark does not mean the business has no rights over its brand, but it significantly weakens the ability to enforce those rights and increases the risk of disputes – two factors a due diligence team should assess carefully before completing a transaction.
The first step is to determine whether the trademark has been filed for registration or has already been granted a Trademark Registration Certificate, and, equally important, whether the scope of protection under the Nice Classification actually covers the company’s core business activities. For a health technology platform, this scope typically extends beyond Class 44 for medical services to include Class 42 for technology services and software-as-a-service, Class 9 for software as a product, and Class 10 where the platform sells or distributes medical devices. In practice, Class 9 is the class most often overlooked, even though it is the class that protects the software product itself – one of the core assets of the business model.
In addition, the status of the application should be reviewed – under examination, granted, refused, or subject to opposition or a third-party complaint – along with a preliminary assessment of the risk of conflict with trademarks already registered in the same health technology segment. This review becomes even more important where the company plans to expand into new markets or raise capital from foreign investors, who typically require a “clean” trademark position before releasing funds.
Overall, an unregistered trademark, or one registered without covering the company’s core classes, is a risk that is easy to quantify but frequently underestimated in due diligence. It directly affects the company’s ability to protect its brand after the transaction, particularly where the target company is preparing to scale up using the very capital it has just raised.
3.4. Software and third-party copyright
For technology platforms, intellectual property risk arises not only from assets the business has developed itself, but also from the use of third-party assets in building the product.
One common source of risk is open-source components integrated into the product. Each open-source library or codebase comes with its own licence terms – commonly GPL, MIT, or Apache – and not every licence is compatible with commercialisation. Certain copyleft licences, GPL being the most well-known example, may trigger an obligation to disclose derivative source code, which conflicts directly with commercialising the product on a proprietary basis. Similarly, for third-party APIs or SDKs used by the platform, the terms governing the collection, storage, and sharing of user data need to be carefully cross-checked against the platform’s own data policy and business model, to avoid a conflict between the commitments made to users and the terms imposed by the service provider. In addition, medical content such as illustrative images, drug databases, or professional articles may also be subject to copyright protection, so their provenance – whether produced in-house or properly licensed – should be established to avoid infringing third-party copyright.
This is a technically oriented risk category that is easily missed in a standard due diligence process, as it requires close coordination between legal counsel and the technical team to carry out a parallel technical due diligence exercise. For platforms where software is the core asset, an open-source licence violation is not merely a risk on paper – it can force the company to rewrite part of the product, directly affecting the implementation timeline and the costs incurred after the transaction.
3.5. Common red flags
In summary, there are three categories of red flags that a due diligence team should pay particular attention to: (i) the absence of an intellectual property assignment agreement with the original developers or development team; (ii) an unregistered trademark, or one registered without covering the relevant classes, while the product has already been commercially launched in the market; and (iii) the use of copyleft open-source components (such as GPL) in a commercial product that has never been reviewed for licence compliance.
IV. PERSONAL DATA AND COMPLIANCE
Healthcare Intermediary Service Providers not only connect service users with medical examination and treatment establishments but also directly collect, store, and process personal data. The data collected by these platforms includes not only basic personal data such as identifying information but also sensitive personal data such as data reflecting the health status of users. Therefore, alongside contents regarding licensing and intellectual property rights, assessing the level of compliance with personal data protection laws is a critical component in the legal due diligence process.
4.1. Formulation of internal policies, procedures, and regulations on personal data processing and protection
Article 3.4 of the Law on Personal Data Protection 2025 stipulates one of the important principles of personal data protection: “Synchronously and effectively implement appropriate institutional, technical, and human measures and solutions to protect personal data”. To ensure compliance with this principle, Healthcare Intermediary Service Providers need to prepare, formulate, review, and synchronously implement internal policies, procedures, regulations, and forms regarding personal data protection. These documents and instruments typically include:
- Internal personal data processing and protection procedures and policies;
- Publicly posted personal data processing policies that users can access via the website or application of the Healthcare Intermediary Service Provider;
- Decisions on the designation of the department and personnel in charge of personal data protection;
- Personal data processing notices and agreements between the Healthcare Intermediary Service Provider and its employees, and between the Healthcare Intermediary Service Provider and its customers;
- Other forms for data subjects to exercise their rights in accordance with the law, such as the right to withdraw consent, and the right to request the provision, correction, or deletion/erasure of personal data.
At the same time, given that medical data constitutes sensitive personal data, the processing of this type of data must comply with stricter requirements compared to basic personal data. Therefore, these documents must reflect the following fundamental contents:
- Regulations on access control and authorization, processing workflows, and security measures applied during the processing;
- Regulations on the application of appropriate security measures such as encryption, anonymization, and the protection of storage and transmission equipment when transferring data;
- Data subjects must be notified that the data to be processed is sensitive personal data when obtaining their consent;
- Note that small enterprises29 and start–up enterprises30 that directly process sensitive personal data are not entitled to apply the mechanism for delaying the performance of obligations for a term of 05 years regarding general obligations on personal data protection, including the formulation of personal data processing impact assessment dossiers (“DPIA Dossier”), cross-border personal data transfer impact assessment dossiers (“DTIA Dossier”), and the designation or hiring of a department and personnel to perform personal data protection work.
In summary, the aforementioned documents and instruments serve as vital evidentiary documents ensuring compliance with regulations on personal data protection, as they demonstrate how the Healthcare Intermediary Service Provider synchronously executes and deploys institutional, technical, and human measures and solutions throughout its operations. Concurrently, several documents listed above, such as the Decision on designating the department and personnel for personal data protection, the Personal Data Processing Agreement with employees, or the Consent Notice… are mandatory components of the DPIA Dossier and DTIA Dossier that the Healthcare Intermediary Service Provider must formulate, submit to the Ministry of Public Security, and store in accordance with statutory regulations.
4.2. Delineation of roles of the parties in the process of personal data processing
A critical component of the due diligence process is accurately determining the role of the Healthcare Intermediary Service Provider in each personal data processing activity. In practice, a platform may concurrently assume multiple roles with respect to different datasets. Current laws distinguish between the Personal Data Controller, the Personal Data Processor, and the Personal Data Controller-cum-Processor, each carrying corresponding legal obligations.
When multiple parties jointly process data, in addition to the rights and obligations under Article 37 of the Law on Personal Data Protection 2025, the delineation of roles and responsibilities of each party is typically expressed through personal data processing agreements (“DPA”) between the parties. Therefore, it is necessary to review DPAs executed with hospitals, clinics, and service providers to evaluate the delineation of roles, scope of data processing, data protection measures, and the risk/liability allocation mechanism among the parties.
4.3. Formulation, submission, and retention of personal data processing impact assessment dossiers and cross-border personal data transfer impact assessment dossiers
One of the most important administrative obligations regarding personal data protection that Healthcare Intermediary Service Providers must ensure is the obligation to formulate, submit, and retain DPIA Dossiers with the Ministry of Public Security. In the event that cross-border personal data transfer activities occur, the enterprise must additionally formulate, submit, and retain a DTIA Dossier. The components of the dossiers, orders, and procedures for implementation are stipulated under Articles 21 and 22 of the Law on Personal Data Protection 2025 and Articles 19 and 20 of Decree No. 356/2025/ND-CP.
In case the DPIA Dossier or DTIA Dossier is approved by the Ministry of Public Security, the Ministry of Public Security will issue a Result Notice via the Public Service Portal of the Ministry of Public Security or send an electronic/hard-copy document according to the information provided by the submitting organization or individual. Therefore, during the legal due diligence process, it is necessary to verify whether the enterprise has formulated, submitted, and retained the DPIA Dossier, and simultaneously determine whether the obligation to formulate a DTIA Dossier arises in order to verify that the enterprise has completed its obligation to submit the DTIA Dossier to the Ministry of Public Security and is retaining these DPIA and DTIA Dossiers in accordance with regulations.
4.4. Obligations on personal data retention in the healthcare sector
The healthcare sector is simultaneously governed by personal data protection laws and specialized laws on medical examination and treatment. While personal data protection laws recognize the data subject’s right to request data deletion in certain cases,31 specialized laws require medical record files to be retained for a statutorily defined period to serve professional activities and state management.32 This indicates that the data subject’s right to request data deletion is not an absolute right.
For data constituting medical record files, the enterprise may have legal grounds to continue retaining the data despite the data subject’s request for deletion. Conversely, for data serving the operational activities of the platform, such as appointment booking history or marketing data, the enterprise needs to separately evaluate the grounds for retention for each type of data. Therefore, the due diligence process needs to assess whether the enterprise has established an appropriate data classification mechanism. Failure to clearly distinguish between data belonging to medical record files and operational data of the platform may escalate compliance risks as well as create difficulties when handling data subject requests.
4.5. Summary of key matters for consideration
From a legal due diligence perspective, the assessment of compliance with personal data protection laws must examine the entire data processing workflow of the enterprise. Accordingly, the key matters to be reviewed include:
- Personal data protection policy: Review the issuance of internal policies, procedures, and the designation of personnel in charge of personal data protection.
- Data processing roles and DPAs: Identify the roles of the enterprise and review the DPAs.
- DPIA and DTIA Dossiers: Check the formulation, submission, and retention of DPIA and DTIA Dossiers.
- Data retention: Assess the classification and retention of data, and the handling of data subject requests in accordance with statutory regulations.
For investors, these issues not only increase the risk of the enterprise incurring legal liability or administrative sanctions but can also directly impact the results of the legal due diligence, the risk allocation mechanism, post-transaction indemnity obligations, and corporate valuation. In a context where health data is increasingly becoming a vital asset of digital health platforms, the maturity of the personal data governance system is also an important criterion for evaluating the legal quality of the target company in M&A transactions.
GENERAL CONCLUSION
The three areas discussed – licensing, intellectual property, and personal data – do not exist in isolation within a Healthcare Intermediary Service Provider; rather, they are closely interwoven. The operating model determines the licensing obligations that apply, the technology product creates intellectual property assets whose ownership must be clearly established, and that very product is also the tool used to collect and process users’ health data. Legal due diligence on this category of business therefore cannot be carried out in isolated segments, but requires a holistic approach spanning the company’s legal structure and its actual day-to-day operations.
For investors, early detection of red flags across these three areas provides the basis for negotiating conditions precedent to disbursement, adjusting the risk-allocation mechanism, or requiring the seller to remediate issues before completion. For health technology start-ups themselves, proactively reviewing and completing their legal documentation across all three areas before entering a fundraising round not only reduces the risk of being undervalued, but also significantly shortens negotiation time and increases investor confidence.
(15) Clauses 1, 2, 4, 6 and 19, Article 2 of the Law on Medical Examination and Treatment 2023.
(16) Article 3.4 of the Law on E-Commerce 2025.
(17) Articles 18, 25 and 26, and Articles 27 to 30 of Decree No. 248/2026/ND-CP.
(18) Articles 23 and 24, Clause 3 Article 52, and Article 53 of Decree No. 248/2026/ND-CP. Websites and applications for which notification or registration was confirmed before 1 July 2026 may continue operating in accordance with the confirmed contents until 30 June 2027 and must amend or supplement their dossiers under the new regulations during the transitional period.
(19) Articles 48, 49 and 50 of the Law on Medical Examination and Treatment 2023.
(20) Articles 52 and 54 of the Law on Medical Examination and Treatment 2023.
(21) Article 19 of the Law on Medical Examination and Treatment 2023.
(22) Article 121 of the Law on Medical Examination and Treatment 2023.
(23) Article 20.4.dd of the Law on Advertising 2012, as amended and supplemented in 2025; Circular No. 09/2015/TT-BYT.
(24) Article 79 of the Law on Pharmacy 2016, as amended and supplemented in 2024; Article 11.1.d of Decree No. 163/2025/ND-CP.
(25) Article 104 of Decree No. 163/2025/ND-CP.
(26) Article 80 of the Law on Medical Examination and Treatment 2023; Article 87 of Decree No. 96/2023/ND-CP.
(27) Clauses 8 to 11, Article 87, and Article 88 of Decree No. 96/2023/ND-CP.
(28) It should be noted that Vietnam’s National Office of Intellectual Property (NOIP) currently takes a fairly strict view when assessing the patentability of computer programs and purely algorithmic solutions, since “computer programs” as such are not protectable as patents under current law. In practice, most algorithms and software solutions used by health technology platforms are more effectively protected through a combination of copyright and trade secret protection, rather than by pursuing patent registration – except where the solution is tied to a specific technical mechanism or device that fully satisfies the criteria of novelty, inventive step, and industrial applicability.
(29) According to Article 4 of the Law on Support for Small and Medium Enterprises 2017 and Article 5.2 of Decree No. 80/2021/ND-CP: “Small enterprises in the sectors of agriculture, forestry, and aquaculture; industry and construction employ an annual average number of employees participating in social insurance of not more than 100 people and have a total annual revenue of not more than VND 50 billion or a total annual capital source of not more than VND 20 billion. Small enterprises in the sectors of commerce and services employ an annual average number of employees participating in social insurance of not more than 50 people and have a total annual revenue of not more than VND 100 billion or a total annual capital source of not more than VND 50 billion”.
(30) The current law does not provide a specific definition for “startup enterprise”, instead, Article 3.2 of the Law on Support for Small and Medium Enterprises 2017 stipulates: “Innovative startup small and medium enterprise means a small and medium enterprise established to realize ideas on the basis of exploiting intellectual property, technology, and new business models and having the capacity for rapid growth”.
(31) Article 4.1.d and Article 14.1.a of the Law on Personal Data Protection 2025.
(32) Appendix of Circular No. 33/2025/TT-BYT.
Submission date: July 20 2026
Author: Han Tran, Thao Vo, Nam Nguyen
Disclaimers:
This article is for general information purposes only and is not intended to provide any legal advice for any particular case. The legal provisions referenced in the content are in effect at the time of publication but may have expired at the time you read the content. We therefore advise that you always consult a professional consultant before applying any content.
For issues related to the content or intellectual property rights of the article, please email cs@apolatlegal.vn.
Apolat Legal is a law firm in Vietnam with experience and capacity to provide consulting services related to Business and Investment and contact our team of lawyers in Vietnam via email info@apolatlegal.com.
Nguồn: https://ift.tt/bGAEhpP
Map: https://goo.gl/maps/JbCF1FiWPuD2Jsnx6
Thông tin: https://www.google.com.vn/search?q=Apolat+Legal&kponly=&kgmid=/g/11jkvqgmw_
Comments
Post a Comment