Legal Counsel, Data Privacy & AI

Nelly; Hamburg; On-site; EUR 65,000 - 90,000; Full time

Benefits offered by this job

Transit ticket

Urban Sports Club membership

€500 L&D budget

Hybrid setup

Workations (up to 4 weeks)

Dog-friendly office

Snacks & drinks

Job summary

Nelly is seeking a Legal Counsel focused on Data Privacy & AI to join our Legal team in Hamburg or Berlin. You’ll independently manage DPAs and vendor privacy reviews, guide new products from a data protection perspective, and serve as the point of contact for all teams on data protection issues.

You’ll shape data protection at Nelly as an integral part of our product, balancing highly sensitive patient data with rapid development in healthcare tech.

Qualifications

• First and second state examinations or a master’s degree in business law.
• 1–3 years of professional experience in data protection, ideally in-house.
• Fluent German and English in spoken and written; knowledge of GDPR and local data protection regimes.

Responsibilities

• Review and implement internal data protection processes and documentation.
• Support the launch of new products from a data protection perspective and establish the necessary legal framework.
• Advise employees across all departments on all data protection-related issues.
• Identify and resolve data protection issues and risks.
• Ensure compliance with the legal framework for the use of AI in healthcare, including payment and billing processes.
• Serve as the central point of contact for clients and the team on all data protection matters.

Skills

Data privacy

DPA management

Vendor privacy reviews

German & English fluency

Communication skills

Education

First and second state examinations or a master’s degree in business law

Tools

APIs

Cloud infrastructure

Job description

We are looking for a Legal Counsel (focus on Data Privacy & AI) for our Legal team in Hamburg or Berlin.

At Nelly, we navigate the tension between highly sensitive patient data and product development that has no time for red tape. This role gives you responsibility for how we address this: You’ll independently manage DPAs and vendor privacy reviews, guide new products from the very beginning from a data protection perspective, and serve as the point of contact for all teams when it comes to data protection issues. You’ll shape what data protection looks like at Nelly as an integral part of the product.

About Nelly

We are building the AI-Driven Financial Operating System for European healthcare, solving the biggest challenges for patients and practices. We create what no bank or software platform can handle. Our all-in-one platform transforms chaotic administrative processes into intelligent, automated workflows, from patient care to billing to next-generation payments. Because we truly believe: healthcare should be less about paperwork and more about people.

Why?

Because Europe is facing a massive shortage of medical professionals. And if we don't rethink the way practices work, the system won’t be able to keep up. With our Series B funding of over €50 million from world-class investors, we are turning our vision into reality.

What sets us apart: We work with the best team, which is why we give everything together every day. We believe in Talent Density, because exceptional people make everyone around them better. At Nelly, we move fast and expect everyone to keep up. Stagnation isn’t an option, which is why we invest heavily in growth. AI isn't a nice-to-have at Nelly. We expect you to use it every day and give you everything you need to do so. You get trust and ownership and we expect you to speak up, even when it’s uncomfortable.

Joining us

• Independently reviewing, further developing, and implementing our internal data protection processes and documentation
• Supporting the launch of new products from a data protection perspective and establishing the necessary legal framework
• Advising employees across all departments on all data protection-related issues
• Identifying and resolving data protection issues and risks
• Ensuring compliance with the legal framework for the use of AI in healthcare, including payment and billing processes
• Serving as the central point of contact for clients and the team on all data protection matters

What you’ll bring

• First and second state examinations or a master’s degree in business law
• 1–3 years of professional experience in data protection, ideally in-house
• Proficiency in the GDPR as well as national data protection laws (e.g., BDSG), the European Health Data Space (EHDS), and sector-specific regulations (e.g., DiGAV, SGB V)
• Strong understanding of products and technology: You can quickly familiarize yourself with APIs, cloud infrastructure, and data flows to help shape data protection-compliant architectural decisions
• Precise, clear communication and fluency in spoken and written German and English

What we offer

• Deutschlandticket (public transport pass covering all of Germany) or Swapfiets membership, so you get around the city fast
• Urban Sports Club membership, for sport and balance
• 500€ L&D Budget to develop yourself
• Flexible working hours and a hybrid setup
• Up to 4 weeks of workation
• A dog‑friendly office with great vibes and a team that’s fun to work with
• Snacks and a fridge full of cold drinks

We welcome applications from people of all genders and backgrounds, regardless of origin or age. If you’re convinced you’re the right fit for this role – even if your CV doesn’t match the requirements 100% – tell us why.