Mercy Ulo
Senior Attorney
Mercy Ulo advises life sciences, healthcare, and technology clients on privacy, AI governance, commercial contracting and novel data use cases. Clients turn to her for practical counsel on product launches, patient support programs, supplier relationships and the responsible use of health data in highly regulated environments.
Mercy’s practice is shaped by significant in-house and seconded experience with pharmaceutical, healthcare, and technology companies. She has supported teams with HIPAA, CCPA/CPRA, VCDPA, Washington and Nevada consumer health data laws, the Colorado AI Act, DOJ Bulk Data Security Rule, GDPR, CAN-SPAM, TCPA, and related privacy and security frameworks.
She works closely with legal, market access, regulatory, commercial operations, business analytics, information technology, product, engineering, procurement, R&D, and human resources stakeholders. Her advice is designed to help business teams move complex initiatives forward while building privacy by design, risk assessment, and compliance controls into the initiatives.
Her work includes counseling on drug and mobile device launches, patient recruitment and engagement portals, branded sites, clinical trial platforms, mobile healthcare applications, privacy notices, terms of use, generative AI, incident response, cross border data transfer, supply agreements, and professional services contracts.
Mercy also brings a program-builder’s perspective. She has helped implement privacy laws across large enterprises, assisted with direct-to-consumer initiatives and helped launch a first of its kind online platform designed to provide select prescription medications at reduced prices for eligible cash-pay, uninsured, or self-paying U.S. patients.
Focus Areas
Mercy’s practice focuses on privacy, cybersecurity and artificial intelligence for life sciences and healthcare organizations including:
- State privacy laws, including CCPA, WMHMDA and other emerging privacy laws
- GDPR, PIPEDA, LGPD and international data protection compliance
- Patient support programs, market access data governance, and product launch counseling
- Global cybersecurity incident response and third-party risk management
- Data protection provisions in commercial, technology and clinical trial agreements
- Digital health initiatives, mobile applications and patient recruitment and engagement platforms
- Clinical research privacy, including informed consent, cross border transfers and data protection impact assessments
- AI governance and privacy by design
Representative Experience
- Supporting drug product launches by advising on HIPAA and state privacy law issues.
- Drafting and negotiating business associate agreements, data processing agreements, cybersecurity addenda and standard contractual clauses.
- Serving as a key privacy stakeholder to U.S. Market Access data governance committees focused on data use and patient support program design, implementation, and operation.
- Assisting with state privacy law implementation by analyzing exemptions, preparing DSAR templates, and drafting implementation guides for emerging privacy, consumer health data, and AI laws.
- Completing data protection impact assessments for high-risk processing activities, including generative AI initiatives and projects involving sensitive health data.
- Performing assessments of vendor, partner and third-party privacy and cybersecurity controls.
- Supporting drug manufacturer direct-to-consumer initiatives including the launch of a patient platform offering reduced-price access to select medications.
Differentiators
Mercy’s work is distinguished by a focus on business minded, strategic legal counsel. Her approach to helping clients is grounded in the perspective of someone who has advised from multiple vantage points: as in-house counsel, law firm counsel, and seconded counsel embedded with pharmaceutical, technology, and healthcare companies. That experience gives her a practical understanding of how privacy, AI governance, commercial contracting, and data use decisions affect product launches, patient programs, market access strategy, and day-to-day business operations.
Mercy works seamlessly with cross-functional teams. She helps those teams translate complex legal requirements into practical tools, playbooks, policies, templates, training, and frameworks that can be implemented operationally.
Thought Leadership, Teaching, & Ventures
- Active participant in pharmaceutical and medical device consortium representing companies in benchmarking forums.
- Participates in industry discussion on US and LATAM privacy law, and AI regulation.
Education
- M.P.H., Public Health, Harvard University School of Public Health
- J.D., Law, New York University School of Law
- B.A., Political Science and Spanish, Tufts University
- Study Abroad, Universidad Católica de Chile
Admissions & Affiliations
- Massachusetts
- District of Columbia
- Certified Information Privacy Professional/United States
- Certified Information Privacy Professional/Europe
- Certified Information Privacy Manager
- International Association of Privacy Professionals, Member
- International Pharmaceutical & Medical Device Consortium, Member
Honors & Awards
- BLAPA Award for Excellence in Public Service
- PILC Fellowship, Organization of American States
Personal
Mercy is actively involved in teaching youth and mentoring young attorneys in her state. Her language skills include Spanish and Portuguese which she has used in her pro bono practice representing unaccompanied minors and asylum seekers in immigration proceedings.