Junior Legal Counsel – Privacy, Tech & Compliance

About the company

What’s Promptly in a nutshell

Promptly is building the first patient-centered global evidence network, offering real world data sharing and monetization capabilities. Together with a selected network of Partners, we generate new knowledge from harmonized datasets, augmented with the collection of longitudinal patient-reported data and patient-generated digital biomarkers within a secure and privacy-preserving environment.

We answer the question – is this patient treatment the best it could possibly be?

What’s our purpose

We exist to empower every patient and every health organization on the planet with evidence on the outcomes of care!

Why do we get up in the morning? Well, most healthcare professionals have chosen to work in healthcare driven by their desire to make a difference in patients’ lives. And so have we! We have chosen to follow this calling by addressing the biggest problem in healthcare: the lack of real-world evidence on the outcomes of care.

For us, society denying patients better care due to lack of access to data is unethical, in a world where technology improved so many aspects of our world. Making the right evidence available to healthcare organizations to help prevent one lost life, one care complication, one failed treatment is the moral obligation that big tech companies have – it’s our Hippocratic Oath.

At Promptly, everything we do is driven by our core purpose: to promote better healthcare at lower costs for patients every day, by making health outcomes available.

About Promptly

Promptly builds software that turns real-world clinical data into evidence.

Our technology allows hospitals, research institutions, health authorities and life-science partners to harmonise clinical data to international standards, run analytics on it, and generate the aggregated evidence that improves care and informs health policy.

We are a Portuguese company with a growing footprint across Europe and beyond. That means a broad portfolio of products and solutions, a demanding regulatory perimeter and a legal function that sits close to the product.

The role

You will join Promptly's Legal Team and provide day-to-day support to the company's operations across multiple jurisdictions, products and solutions. This is a hands-on role in a small, senior team, working closely with our Legal Lead. You will be trusted with real matters early, with the guidance and review structure to handle them well.

You will also work directly with engineering, data science, clinical, security, product and commercial teams - and with the Executive Team - often at the same time, often with tight deadlines. This is a fast-paced environment, and the volume and variety of what reaches the Legal Team is the best and the hardest part of the job.

What you will do - Core focus

Data protection and privacy

• Run the day-to-day of Promptly's data protection programme, alongside the Legal Lead.

• Act as a day-to-day point of contact for data protection matters - internally, and in the dialogue with partners, their data protection officers and, where relevant, supervisory authorities.

• Monitor and translate developments in EU and national health-data regulation (including the European Health Data Space) into concrete internal requirements.

• Build awareness across the company: practical training, clear guidance and documentation that non-lawyers actually use.

• As you develop in the role, take on increasing formal responsibility within Promptly's data protection governance structure.

Contracts and commercial support

• Draft, review and negotiate the full contractual cycle;

• Support commercial and partnership teams in negotiations with key players, in Portugal and internationally.

• Respond to legal, privacy and security sections of tenders, RFPs and customer due-diligence questionnaires.

• Maintain and improve the contract templates, playbooks and clause library the business relies on.

Information security and cybersecurity

• Support the governance of our information security management system and its certification and audit cycles.

• Contribute to incident response: assessment, notification analysis, documentation and lessons learned.

• Track applicable cybersecurity regulation and sector requirements and assess their impact on our products and partners.

Intellectual property

• Protect Promptly's proprietary software, data models, know-how and brand.

• Advise on IP ownership, licensing and background/foreground allocation in customer contracts and research collaborations, including publication and results-exploitation rights.

• Manage the trademark portfolio and coordinate with external IP counsel.

AI, digital regulation and compliance

• Support the company's readiness for the EU AI Act and the development of internal AI governance policies, model and data-licensing positions, and responsible-AI documentation.

• Advise on regulatory touchpoints for health software, including medical device and clinical research requirements where applicable.

• Draft, implement and roll out internal policies;

• Support third-party due diligence, anti-bribery, whistleblowing and other compliance processes.

• Public procurement: support to tenders and contracting with public entities, including national and EU procurement rules and the obligations they carry through the life of a contract.

• Employment law: employment contracts and policies, remote and cross-border hiring questions, contractor arrangements, day-to-day people-team support.

• Corporate law: corporate housekeeping, board and shareholder documentation, subsidiaries, and support on financing or M&A due diligence.

• Disputes: pre-litigation analysis and coordination of external counsel.

You are not expected to be an expert in these areas on day one. You are expected to engage with them seriously, learn fast, and know when to escalate.

What we require

• Master's degree in Law.

• 3+ years of relevant post-qualification experience in a reputable law firm and/or an in-house legal department.

• Based in Porto, or able to reach our Porto office at short notice. The role is remote-first, but it is not location-neutral: working closely with the Legal Lead means regular in-person time.

• Demonstrable experience of fast-paced, high-pressure environments: competing priorities, short deadlines, incomplete information, and the judgement to know what matters most today.

• Fluent English, written and spoken: English is our working language for contracts, negotiations, documentation and most internal communication. You will draft and negotiate complex agreements in English every week.

• Proficiency with AI tools and AI-assisted legal processes: we expect you to already use AI in your daily legal work and to have sound judgement about verification, confidentiality, privilege and the limits of these tools.

• Strong command of digital work tools: Slack, Microsoft 365, SharePoint, Notion, e-signature platforms, contract and document management systems. You should be comfortable working, documenting and collaborating entirely in writing and entirely online.

What we would love to see

• Prior experience in health, health technology, life sciences and technology environments.

• Practical experience in data protection, intellectual property, compliance, information security, cybersecurity, contracts or other digital-law areas.

• Experience with GDPR in health-data contexts.

• Enrolment with the Portuguese Bar Association (Ordem dos Advogados) or equivalent, or eligibility for it.

• Experience with public procurement, EU-funded projects or research consortia (Horizon Europe, IHI and similar).

• Exposure to multi-jurisdictional work across the EU, UK and US.

• Experience supporting product and engineering teams directly.

How you will need to work

• Ease in building relationships. You will work with engineers, data scientists, clinicians and commercial teams who do not think like lawyers and do not need to. Your effectiveness depends on people wanting to bring you in early.

• Strong communication and reasoned argument. You can explain a complex legal position in plain language, defend it with reasoning rather than authority.

• Excellent organisational skills and a high sense of responsibility. You will carry a high volume of parallel matters, deadlines and records at once. Nothing can fall through.

• The ability to work within established structures. We already have processes, templates, registers and ways of documenting things. We need someone who adopts them rigorously and improves them from the inside, rather than starting again.

• Pragmatism. We need advice that enables decisions. Identifying a risk is the first half of the work; proposing a workable path through it is the second.

• Composure under pressure. Incidents, deal deadlines and regulatory questions rarely arrive one at a time.

What we offer

• Remote-first work with real flexibility and a team built around asynchronous, written collaboration.

• A legal function treated as a strategic partner, with a direct line into product and engineering.

• An Individual Training Plan - conferences, courses, books, certifications. It is a structured plan: it requires you to define a concrete career-development strategy and the actions to get there.

• Health insurance.

• Personal accident insurance.

• IT equipment provided, plus anallowance for electronic equipment and office material.

• Time together as a team: All Hands and regular team dynamics, because remote does not have to mean distant.

• Work that matters. The evidence our partners generate with our technology informs real clinical and policy decisions.

Privacy notice for applicants

Promptly - Software Solutions for Health Measures, S.A. (“Promptly”) is the controller of the personal data contained in your application. We process that data to manage our recruitment activities: reviewing applications, organising and conducting interviews, tests and assessments, evaluating candidates, communicating with you throughout the process and, where an offer is made, preparing your hiring. We do so on the basis of the steps taken at your request prior to entering into a contract, and of our legitimate interest in selecting suitable candidates for the role. Your data is accessible only to the members of the Promptly team involved in the selection process and to service providers that support the tools we use to manage it, acting on our instructions and bound by confidentiality and data protection obligations. We do not use your data for purposes unrelated to recruitment, we do not share it with third parties for their own purposes, and we do not take decisions about you based solely on automated processing.

If you are not selected, we keep your application for up to 12 months so that we may contact you about future openings that match your profile. You may ask us to delete it at any time, and we will do so.

You have the right to access, rectify, erase, restrict and port your personal data, and to object to its processing. To exercise these rights, or to ask any question about how we handle your data, write to dpo@promptlyhealth.com. You may also lodge a complaint with the Portuguese supervisory authority (Comissão Nacional de Proteção de Dados - CNPD).

Applicant declaration

By submitting this application, I confirm that the information provided by me, and in any documents attached to it, is true and complete to the best of my knowledge, and that I have not omitted any material fact. I confirm that I have disclosed any previous employment or engagement with Promptly. I accept that if any of the information provided is false or incorrect, my application may be rejected, any offer of employment may be withdrawn and, where employment has already begun, this may constitute grounds for disciplinary action, including termination, in accordance with applicable law.

Privacy notice for applicants

Promptly - Software Solutions for Health Measures, S.A. (“Promptly”) is the controller of the personal data contained in your application. We process that data to manage our recruitment activities: reviewing applications, organising and conducting interviews, tests and assessments, evaluating candidates, communicating with you throughout the process and, where an offer is made, preparing your hiring. We do so on the basis of the steps taken at your request prior to entering into a contract, and of our legitimate interest in selecting suitable candidates for the role. Your data is accessible only to the members of the Promptly team involved in the selection process and to service providers that support the tools we use to manage it, acting on our instructions and bound by confidentiality and data protection obligations. We do not use your data for purposes unrelated to recruitment, we do not share it with third parties for their own purposes, and we do not take decisions about you based solely on automated processing.

If you are not selected, we keep your application for up to 12 months so that we may contact you about future openings that match your profile. You may ask us to delete it at any time, and we will do so.

You have the right to access, rectify, erase, restrict and port your personal data, and to object to its processing. To exercise these rights, or to ask any question about how we handle your data, write to dpo@promptlyhealth.com. You may also lodge a complaint with the Portuguese supervisory authority (Comissão Nacional de Proteção de Dados - CNPD).

Applicant declaration

By submitting this application, I confirm that the information provided by me, and in any documents attached to it, is true and complete to the best of my knowledge, and that I have not omitted any material fact. I confirm that I have disclosed any previous employment or engagement with Promptly. I accept that if any of the information provided is false or incorrect, my application may be rejected, any offer of employment may be withdrawn and, where employment has already begun, this may constitute grounds for disciplinary action, including termination, in accordance with applicable law.