Senior Privacy Manager

Who We Are:

Therabody® is the wellness tech leader with a mission to inspire and enable everybody to feel, perform and look their best. Therabody’s product ecosystem includes category-creating innovations in wellness, performance and beauty products, proprietary software and digital content. Not only is it part of our brand ethos to help others, but we are also defining the cutting edge of wellness technology while winning accolades such as Fast Company’s Brands That Matter, Oprah's Favorite Things and the TIME Best Inventions 2025 award.

We’re committed to continuous innovation and surround ourselves with specialists, thought leaders, and experts - inside and outside of the office. If you thrive in creative environments, are concerned with big, innovative ideas, love to collaborate, have an entrepreneurial spirit, and are driven to succeed, get in touch with us. Together we can push the limits of what can be achieved for everybody.

Who We’re Looking For:
We are seeking a Senior Privacy Manager to own the day-to-day operation of Therabody’s global privacy program and to serve as the critical liaison between Legal, Technology, Product, Marketing, and Security teams. Reporting to the VP, Deputy General Counsel, this role carries end-to-end operational ownership of the program across every market in which Therabody operates. The successful candidate will ensure privacy requirements are translated into practical, scalable processes and technical implementations across the organization — in the EU/UK, the United States, Canada, Australia and New Zealand, and emerging APAC markets. The initial focus will be supporting new product introductions involving connected devices, ensuring privacy is embedded into product development from design through deployment.

The ideal candidate combines deep, current knowledge of global privacy and consumer health data regulation with hands-on experience working alongside engineering and product teams to operationalize privacy programs at scale.

Key Responsibilities

• Partner with in-house and outside counsel to translate privacy laws, regulatory requirements, and company policies into operational requirements and controls.●      Collaborate with Product, Engineering, IT, Marketing, and Security teams to translate privacy requirements into technical and operational controls.
• Lead privacy-by-design initiatives throughout the product development lifecycle.
• Serve as privacy program lead for new product introductions involving connected hardware, biometric and physiological data, and companion application ecosystems, ensuring compliance is integrated into product architecture and workflows.
• Conduct and facilitate Privacy Impact Assessments (PIAs), vendor questionnaires, and Data Protection Impact Assessments (DPIAs).
• Develop, implement, and maintain privacy policies, standards, and operational procedures.
• Coordinate cross-functional efforts to address privacy risks, remediation activities, and ongoing compliance initiatives.
• Partner with Information Security on data governance, data classification, retention, and incident response activities.
• Monitor changes in privacy laws and industry best practices, recommending updates to internal processes as needed.
• Manage vendor privacy reviews and third-party risk assessments, including sub-processor diligence and onward transfer terms.
• Develop training and awareness programs to promote privacy compliance across the organization.
• Own global data subject rights operations — intake, identity verification, and fulfillment within statutory deadlines across all applicable jurisdictions.
• Maintain records of processing activities (GDPR Article 30), data inventories, and data maps as products, systems, and vendors change.
• Own consent and preference management across web, app, and marketing channels, including cookie and tracking technology governance globally.
• Partner with Marketing and Digital on advertising technology governance — pixels, SDKs, and tag management — and on mitigating tracking-related regulatory and litigation exposure.

Qualifications

Required

• Bachelor's degree in Information Systems, Business, Computer Science, Cybersecurity, Legal Studies, or a related field, or equivalent practical experience.
• 7+ years of experience in privacy, information governance, compliance, cybersecurity, product management, or a related discipline, including demonstrated ownership of privacy program operations in a multi-jurisdictional environment.
• Experience working across legal and technical teams to implement privacy requirements.
• Working knowledge of the global privacy landscape, including the EU and UK GDPR, US state comprehensive privacy laws (CCPA/CPRA and successor statutes), and consumer health data laws such as Washington’s My Health My Data Act and Nevada SB 370.
• Strong project management and cross-functional communication skills.
• Ability to translate legal and regulatory language into actionable business and technical requirements.
• Demonstrated experience handling sensitive and special category personal data, including health and biometric data.
• Hands-on experience operating data subject rights workflows and cross-border transfer mechanisms at production scale.

• Preferred
• Professional certifications such as CIPP/US, CIPP/E, CIPM, CIPT, or Certified Information Privacy Manager.
• Experience supporting connected devices, IoT, digital health, or consumer technology products.
• Familiarity with software development lifecycles, cloud platforms, APIs, identity management, and data governance.
• Experience implementing Privacy by Design principles within Agile product development environments.
• Hands-on administration of privacy management platforms such as OneTrust, Transcend, Osano, or comparable tooling.
• Experience supporting a consumer hardware or connected device launch from pre-announcement through general availability.
• Familiarity with SOC 2, ISO/IEC 27001, and ISO/IEC 27701, and how privacy controls map to security certification programs.
• Working knowledge of emerging AI governance frameworks, including the EU AI Act and the NIST AI Risk Management Framework.
• Direct-to-consumer or e-commerce experience, including advertising technology and marketing data governance.

Key Competencies

●      Cross-functional leadership

●      Privacy program management

●      Regulatory compliance

●      Risk assessment

●      Stakeholder management

●      Technical communication

●      Process improvement

●      Data governance

●      Change management

●      Discretion and confidentiality

●      Global and multi-jurisdictional judgment

Success Measures

●      Privacy requirements are incorporated into product development early in the lifecycle.

●      New product introductions launch with documented privacy controls, completed assessments, and defensible records.

●      Privacy reviews are completed efficiently without delaying product delivery.

●      Cross-functional teams have clear ownership and operational processes for privacy compliance.

●      Privacy risks are proactively identified, documented, and mitigated.

●      Data subject rights requests are fulfilled within statutory deadlines, measured against a 100% on-time target.

●      Records of processing activities and data inventories are complete and current for all in-scope systems and vendors.

●      Assessment and vendor review cycle times meet agreed service levels.