REQUEST FOR PROPOSAL: Legal Compliance Consultant

REQUEST FOR PROPOSAL: Legal Compliance Consultant – Digital Health Platform

Family Health International (FHI 360)
Nonprofits / องค์กรไม่แสวงหาผลกำไร
652
02 Jun 2025
25 June 2025

Position Title: Legal Compliance Consultant – Digital Health Platform
Project: Meeting Targets and Maintaining Epidemic Control (EpiC)
Contract Type: Deliverable-Based Consultancy
Period of Performance: June – August 2025

About FHI 360:  

FHI 360 is a global development organization operating in over 70 countries. Under the USAID-funded EpiC project, FHI 360 supports the scale-up of innovative, client-centered HIV services in Thailand. 

EpiC Project: 

Meeting Targets and Maintaining Epidemic Control (EpiC) project, implemented by FHI 360, funded by the U.S. Agency for International Development (USAID), is dedicated to achieving and maintaining HIV epidemic control.  EpiC is led by FHI 360 and draws upon local, regional, and international resource partners to provide technical assistance, as well as global resource partners who bring unique capacities.  

As part of this effort, a nationwide digital platform (TestMeNow.net) is being redesigned to improve access to HIV services, including appointment booking, home delivery of HIV self-test kits, and digital linkage to care. To ensure the platform operates legally and ethically in Thailand, FHI 360 seeks a qualified legal consultant to assess applicable laws and policies, develop legal documentation, and provide risk mitigation guidance.

Objectives of the RFP

The consultant will support EpiC Thailand project in ensuring that the digital platform complies with Thai legal frameworks and operates ethically as an intermediary platform. Objectives include:

Ensure that the online portal TestMeNow.net complies with Thai laws and regulations as an intermediary platform facilitating connections between patients and medical providers.

Develop robust Terms and Conditions (T&Cs), Privacy Policies, and related legal frameworks.

Evaluate the roles and responsibilities of partner clinics and ensure their participation is legally compliant.

Identify any legal risks and provide recommendations to mitigate them, ensuring smooth collaboration with partner clinics.

Key components

Legal Compliance: Addressing regulations such as the Personal Data Protection Act (PDPA), Electronic Transactions Act, intermediary platform obligations and other relevant laws and regulations.

Data Handling: Legal guidance on the secure exchange of personal and medical data via APIs between the portal and partner clinics.

Expected Outcomes

Fully compliant online portal aligned with Thai legal standards for intermediary platforms.

Comprehensive and transparent T&Cs and Privacy Policies that define the portal’s role and responsibilities.

Risk mitigation strategies for operational and data privacy concerns.

Strengthened legal framework for collaboration between the portal and partner clinics.

Required Services

The legal consultant will provide the following:

Legal Compliance Assessment

- Review the platform’s operations and conduct a legal risk assessment focusing on the platform’s role as an intermediary in the digital health ecosystem to ensure alignment with Thai laws and regulations, including but not limited to the Personal Data Protection Act (PDPA), Electronic Transactions Act, and intermediary platform obligations.

- Identify the license, permits, or regulatory notifications required to ensure full compliance and operate a digital health platform in Thailand.

Data Handling Compliance

- Provide legal guidance on the secure exchange of personal and medical data between the platform and partner clinics via APIs.
- Review data flow processes and advise on consent mechanisms, data retention, and user rights in accordance with PDPA and other relevant regulations.
- Recommend improvements to align with international best practices for digital health data protection.

Terms and Conditions & Privacy Policy Development

- Draft clear and comprehensive Terms and Conditions (T&Cs) and Privacy Policies that define the platform’s role as an intermediary, not a healthcare provider.
- Ensure these documents outline user rights, responsibilities, and data usage policies in a legally sound and user-friendly manner.
- Tailor the documents to the platform’s operational model and target audience.

Partner Clinic Compliance and Risk Analysis

- Identify potential legal exposures, including:
  - Breaches of personal data under the PDPA.
  - Liability arising from miscommunication or misinformation between users and partner clinics.
  - Risks associated with cross-border data transfers, if applicable.
  - Non-compliance with telemedicine and online healthcare service regulations.
- Evaluate contractual risks in agreements with partner clinics, especially regarding data sharing, service delivery, and dispute resolution.
- Develop a risk mitigation framework to ensure clinic participation does not compromise the platform’s compliance or expose it to avoidable legal risk including:
  - Legal safeguards in contracts and user agreements.
  - Internal compliance protocols and standard operating procedures (SOPs).
  - Recommendations for insurance or indemnity clauses, if necessary.

Deliverables

The deliverables will include materials of the following types

Legal review report

- Comprehensive report detailing findings of relevant laws and regulation regarding online intermediary platform, medical service operation, telemedicine, and marketing obligations.

Legal and regulatory compliance checklist

- List of licenses, permits in correspond to the relevant laws and regulations

Finalize Term and conditions and Privacy Policies

- Team and conditions, and privacy policies for:

1. - Website usage (required).

1. - Accessing and sharing medical information between network partners (required).

- - Accessing users’ device data such as GPS (optional).

- - Accessing data to improve services and support research (optional)

1. - Online medical service operation and telemedicine

Other materials to support intermediary platform, and medical provider compliance.

Submission Requirements

Interested vendors must submit the following:

Proposal detailing the approach and timeline for the handover deliverables.

Background and Experience

Budget estimate, budget breakdown, including consultant fees, other relevant costs, and final total fixed cost including VAT.

Submission Deadline

Proposals must be submitted no later than June 25, 2025, to the following email address: Procurement.EpiC.TH@fhi360.org

Evaluation Criteria

Proposed Approach: 40%

Relevant experience: 50%

Total cost: 10%

Qualifications

Licensed legal professional in Thailand with experience in digital health, data privacy, or technology law.

Demonstrated knowledge of Thai laws relevant to digital platforms, health services, and data protection.

Experience drafting legal documents for online platforms or health-related services.

Strong communication skills and ability to work independently and remotely.

Fluency in Thai and English (written and spoken)

Confidentiality and Compliance

The consultant must adhere to FHI 360’s confidentiality policies and ensure that all deliverables comply with applicable data protection and ethical standards.

Disclaimers and FHI 360 Protection Clauses:

FHI 360 will not compensate offerors for preparation of their response to this solicitation.

Issuing this solicitation is not a guarantee that FHI 360 will award a subcontract.

FHI 360 reserves the right to issue a subcontract based on the initial evaluation of offers without discussion.

FHI 360 may choose to award a subcontract for part of the activities in the solicitation. FHI 360 may choose to award subcontracts to more than one offeror for specific parts of the activities in the solicitation.

FHI 360 may request from short‐listed offerors a second or third round of either oral presentation or written response to a more specific and detailed scope of work that is based on a general scope of work in the original solicitation.

FHI 360 has the right to rescind a solicitation or rescind an award prior to the signing of a subcontract due to any unforeseen changes in the direction of FHI 360’s client, be it funding or programmatic.

Contact : Procurement.EpiC.TH@fhi360.org

ที่ปรึกษา / Consultant นักกฎหมาย / Lawyer