Philippine nutritionists: RA 10173, PRC license, BIR VAT 12%

Under RA 10173 and NPC guidance, registration is required for personal information controllers (PICs) that process sensitive personal information. Health information about clients — even for a solo practice — falls into the sensitive category, and the NPC has consistently indicated that healthcare providers of any scale are expected to register. The practical threshold for enforcement has focused on larger clinics and healthcare systems, but the legal position is that registration applies. Registration is completed online through the NPC portal, is not onerous, and provides a public accountability record. Beyond registration, the appointment of a Data Protection Officer (DPO) is expected — for a solo practice this can be the practitioner themselves acting as DPO by function, provided the practitioner completes the NPC's DPO training expectations and can genuinely oversee compliance and respond to data subject requests. Ignoring the registration entirely and processing health data at scale without any documented compliance framework is the highest-risk posture.

Not without specific consent to marketing, in general. RA 10173 requires consent to be freely given, specific, informed, and evidenced. Consent obtained for the purpose of delivering nutrition consultation services (contractual necessity) does not automatically extend to marketing communications for new programmes or products. Sending unsolicited marketing WhatsApp messages, especially those categorised as "marketing" templates under Meta's own rules, without documented consent risks: (a) NPC complaint by the recipient; (b) Meta account quality-rating penalties, template rejection, or in severe cases account termination; (c) professional Board complaint if the marketing message crosses the boundary of accurate professional advertising. Best practice is to obtain specific marketing consent as part of the initial client intake process (a separate checkbox or explicit yes/no in the consent form for marketing communications), to periodically revalidate, and to make unsubscribe / opt-out instant and honoured. Transactional messages (appointment reminders, follow-up on prescribed nutrition plan, post-consultation instructions) fall under the contractual necessity basis and do not require separate marketing consent, but the boundary must be respected: those messages must be about the existing service, not thinly disguised marketing.

Most clinics use one or more of: (a) direct GCash or Maya transfer to a business account with the client sending a confirmation screenshot — simple, low cost, but manual reconciliation for the clinic; (b) InstaPay real-time interbank transfer with the client entering the clinic's bank account or QR Ph — instant confirmation but again some manual reconciliation; (c) QR Ph dynamic code generated per transaction — the WhatsApp automation platform sends the QR code image, the client scans and pays, the payment aggregator webhook confirms to the clinic; (d) payment aggregator link (DragonPay, PayMongo, Xendit Philippines, Magpie, GCash for Business or Maya Business merchant account) with all methods presented — most professional and scalable option, adds 2-3% aggregator fee. For corporate wellness programme billing (a hospital chain or corporation invoicing employer clients monthly for a batch of employee consultations), traditional PESONet transfer or direct bank transfer with proper Official Receipt is typical. Cross-border payments from overseas Filipino worker clients or international corporate contracts may use Wise (formerly TransferWise), Payoneer, or SWIFT — with proper AMLC and BSP documentation on both sides.

For self-employed individual professionals with annual gross receipts up to PHP 3 million, the 8% flat option under the Tax Reform for Acceleration and Inclusion Act (TRAIN Law) is often attractive: it substitutes for both graduated income tax and the 3% percentage tax, requires simpler compliance, and is calculated on gross receipts exceeding PHP 250,000. Once gross receipts exceed PHP 3 million in any year, VAT registration becomes mandatory retroactively, and the professional charges 12% VAT on services and files monthly VAT returns; the 8% option is no longer available. Some professionals near the threshold deliberately manage business volume to stay below PHP 3 million; others invest in bookkeeping and accept VAT registration to scale. The choice interacts with client mix: corporate clients often prefer VAT-registered providers (they can claim input VAT credit), while individual retail clients are indifferent. WhatsApp automation platforms should support both tax scenarios in how they handle receipt generation — the same practice may need to switch approach as it grows. A licensed accountant (Certified Public Accountant, CPA) familiar with medical and professional practice taxation is essential; nutritionists should not self-diagnose the tax treatment based on internet forums.

RA 10173 provides for administrative fines, criminal penalties (imprisonment for grave violations), and civil damages. Administrative fines under the recently updated NPC penalties framework can range from tens of thousands to millions of pesos per violation depending on the category, aggravating and mitigating circumstances. Criminal penalties under Sections 25-33 of RA 10173 include imprisonment ranging from six months to seven years and fines from PHP 500,000 to PHP 5,000,000 for offences like unauthorised processing of sensitive personal information, unauthorised access, or concealment of security breaches. In practice, NPC enforcement has focused on: education-first for smaller entities discovering violations for the first time; escalating administrative sanctions for repeat offenders or serious breaches; referral for criminal prosecution in exceptional cases involving harm to data subjects or wilful concealment. Civil damages under Section 34 add exposure — data subjects can sue for actual damages, moral damages, and in some cases exemplary damages. The reputational risk to a nutritionist whose client data breach becomes public knowledge can substantially exceed the financial penalty; word travels fast in professional referral networks, and licensed practitioners have significant exposure to loss of clientele. Compliance is not just legal cost avoidance — it is professional reputation protection.