Privacy & Compliance Specialist

Job description

We are seeking a Privacy & Compliance Specialist to build and run Superpower's privacy and compliance program and accelerate our mission. We are looking for someone who cares deeply about protecting member health data, crossing t’s and dotting i’s, and can think at scale. Critically, you’re excited about joining a fast-growing startup (backed by some of the world's best healthcare investors) on a mission to provide everyone access to the world's best care. This role will own privacy and compliance end-to-end within our longevity and functional medicine model, ensuring that how we collect, use, and protect data and expand operations across 50 states remains safe, compliant, and built to move the business forward rather than slow it down. Key Responsibilities - Build and run Superpower's privacy program end-to-end — data mapping and inventory, privacy notices, consent flows, and data subject / patient rights requests (access, deletion, correction). - Establish how Superpower collects, stores, processes, and uses member health data across EMRs, health information exchanges, genetic reports, wearables, and the AI-powered digital twin. - Run privacy impact assessments and privacy-by-design reviews for new products, features, and services (e.g., prescription peptides). - Manage vendor privacy diligence, data processing agreements, and Business Associate Agreements, and maintain the record of processing and data flows. - Own compliance frameworks and audit readiness (e.g., HIPAA Security Rule, SOC 2) — policies, controls, evidence, and remediation. - Run security and privacy awareness training and maintain the company risk register. - Respond to customer and partner security questionnaires and support due diligence for partnerships and fundraising. - Own incident response and breach assessment / notification workflows, in coordination with Engineering and leadership. - Advise Product and Engineering on practical guardrails for AI-driven clinical recommendations and member data use. - Track evolving state and federal privacy regulations — HIPAA, state health privacy laws (e.g., Washington's My Health My Data Act), CCPA/CPRA, and FTC health data rules — and translate them into concrete internal requirements. Qualifications - 5+ years in privacy and/or compliance, ideally in healthcare or another highly regulated, data-intensive industry, with hands-on experience running a privacy program. - Working fluency with HIPAA and modern privacy laws (state health privacy laws, CCPA/CPRA, FTC health data rules); familiarity with frameworks like SOC 2 a plus. - Ability to research and understand new regulatory requirements. - Independent operator that builds scalable frameworks rather than one-off fixes, flagging risks before they become blockers. - Strong judgment — able to distinguish real risk from theoretical risk, and to know when to escalate to counsel or leadership versus handle it directly. - Excellent communication skills and ability to translate complex privacy and compliance concepts into clear, actionable guidance for non-specialists. - Comfort with ambiguity, cross-functional collaboration, and building 0-to-1 infrastructure in a fast-moving, tech-enabled startup. - Self-starter with a can-do attitude and an ownership mindset — you don't wait to be told what to do. - Strong personal interest in longevity and preventive healthcare. - Privacy certification (e.g., CIPP/US, CIPM, CIPP/E, or CHPC) valued but not required. - No JD or bar membership; this is not a counsel role. Commitment - Full-time. - In-person in San Francisco Why Join Us - Be part of a mission-driven team redefining preventative, root-cause, and longevity-focused care. - Own privacy and compliance end-to-end and be known as someone who makes things possible — clearing the path so the team can move faster, not slower. - Build a modern privacy and compliance function from the ground up, with real ownership and impact beyond a traditional compliance role. - Work directly across Operations, Product, Engineering, Growth, and Clinical on a flat, high-velocity team. ABOUT SUPERPOWER Superpower is a new health system on a mission to extend and enhance human life. We started with lab testing, then data aggregation / digital twin, then an AI doctor, and now peptides. Over the past 6 months, we have grown 10x whilst halving CAC. Now we are gearing up for hyper growth. You can find more about us below: - superpower.com/series-a http://superpower.com/series-a - Superpower Overview https://www.notion.so/1f58444481d080e195dbe2e2e331b3df?pvs=21 - Culture at Superpower https://www.notion.so/Culture-at-Superpower-4321693ee66740e6ad92c449b54f42e2?pvs=21 Company Philosophies - We are all here to genuinely do our life’s best work - Insanely high talent bar, never settling. A players only (see Steve Jobs https://twitter.com/founderspodcast/status/1665442439715225600?s=46&t=PK-vWojaLurY6eXl341Thw) - We live to work as much as we work to live. But we sustainably espouse the superpower ethos of putting health first - We aim to set the gold standard for team health culture on the planet — live the ethos! Investors - Forerunner https://www.forerunnerventures.com/ (Top consumer healthcare VC in the world; early board members of Hims and Oura; Kirsten, founder of Forerunner, led our Series A) - 8VC https://8vc.com/ (leading health and bio investor) - Evan Moore https://www.linkedin.com/in/evanmoore/details/experience/ (Founder of Doordash; Partner at Khosla Ventures) - Cyan Bannister https://wellfound.com/p/cyantist (early investor into Uber and SpaceX, former partner at Founder’s Fund, regarded as one of the top angels in the world) - Balaji Srinivasan https://x.com/balajis (ex-Coinbase CTO and angel, ex-General Partner at a16z) - Arielle Zuckerberg https://www.linkedin.com/in/ariellezuckerberg/ (active angel, tech leader, relatively famous brother) - Cameron & Tyler Winklevoss https://winklevosscapital.com/portfolio/ - Susa Ventures https://susaventures.com/ (tier 1 healthcare VC) - Bond Capital https://www.bondcap.com/ (General Partner Jay Simons https://www.linkedin.com/in/jaysimons/' early-stage fund within Bond) - Long Journey Ventures https://www.longjourney.vc/ (investor in Uber, Notion, Loom, Affirm etc.) - Influencers - Shaan Puri https://x.com/ShaanVP (angel and podcast host of my first million) - Brooke Monke https://www.tiktok.com/@brookemonk_?lang=en (50 million followers across socials) - Logan Paul https://www.instagram.com/loganpaul/?hl=en - Steve Aoki https://www.instagram.com/steveaoki/ - Justin Mares https://x.com/jwmares (founder of Truemed) - Giannis Antetokounmpo https://www.instagram.com/giannis_an34 - Kylian Mbappé https://www.instagram.com/k.mbappe/ We’re proud to be a global team and welcome talent from around the world. We offer visa sponsorship and can support relocation to the United States for the right candidates. Much of our team is international, and we’re committed to building a team of top-tier talent.