Virta Health is on a mission to reverse metabolic disease in one billion people. Current treatment approaches aren’t working—over half of US adults have either type 2 diabetes or prediabetes, and obesity rates are at an all-time high. Virta is changing this by helping people reverse their metabolic condition through innovations in technology, personalized nutrition, and virtual care delivery reinvented from the ground up.

Virta's Legal team seeks a Privacy & Compliance Specialist to own the day-to-day execution of privacy operations, manage cross-functional compliance projects, and serve as a primary point of contact for privacy-related customer and partner inquiries. This individual will work closely with Legal, Engineering, Product, Security, and Commercial teams to maintain and strengthen Virta's privacy posture as the company scales. The role is high-impact and high-autonomy, designed for a subject matter expert who thrives at the intersection of privacy law, project management, and health tech operations.

Responsibilities

The Privacy & Compliance Specialist will be responsible for the following areas of work:

Privacy Program Operations

• With supervision from the Sr. Corporate Counsel and Privacy Officer, manage and maintain Virta’s privacy compliance program, including policies, procedures, and documentation.

• Conduct and coordinate privacy impact assessments (PIAs/DPIAs) and data protection assessments for new products, features, and vendor relationships.

• Maintain records of processing activities (RoPA), data inventories, and data flow maps.

• Monitor and operationalize requirements under HIPAA, state privacy laws (CCPA/CPRA and other state comprehensive privacy laws), and other applicable frameworks.

• Implement and support Privacy by Design across all aspects of Virta’s business.

• Support data subject rights requests (DSARs) and privacy incident response workflows.

Customer and Partner Privacy Support

• Serve as a primary point of contact for privacy and data-related inquiries from customers, prospects, and partners.

• Draft and maintain responses to privacy questionnaires, RFPs, security assessments, and due diligence requests.

• Support the negotiation and review of Data Processing Agreements (DPAs) and Business Associate Agreements (BAAs).

Project Management and Cross-Functional Coordination

• Drive privacy and compliance initiatives from planning through execution, managing timelines, stakeholders, and deliverables.

• Develop and deliver privacy training and awareness programs across the organization, fostering a culture of respect for protected health information and other categories of protected data.

• Build and maintain privacy metrics, dashboards, and reporting for leadership and Board visibility.

• Identify opportunities to improve and automate privacy processes and workflows.

90 Day Plan

Within your first 90 days at Virta, we expect you will do the following:

• Get up to speed on Virta’s privacy program, existing policies, data flows, and key stakeholders across Legal, Engineering, Product, Security, and Commercial teams.

• Take ownership of the privacy impact assessment process and complete at least one PIA/DPIA for a current initiative.

• Assume management of incoming privacy questionnaires, RFPs, and customer/partner privacy inquiries, establishing repeatable response workflows.

• Review existing DSAR and privacy incident response workflows and identify concrete improvement opportunities.

• Begin building privacy metrics and reporting to provide leadership with visibility into program performance and risk posture.