WHOOP says it uses Personal Data for compliance and protection, including to protect against or deter fraudulent, illegal or harmful actions and maintain safety, security and integrity; comply with or enforce legal or contractual obligations, resolve disputes, and enforce its Terms of Use and Terms of Sale; audit internal processes for compliance with legal and contractual requirements and internal policies; protect WHOOP's, your or others' rights, privacy, safety or property (including by making and defending legal claims); and respond to law enforcement requests and as required or permitted by applicable law, court order or governmental regulations.
Supporting quotations
Compliance and protection, including to:
Protect against or deter fraudulent, illegal, or harmful actions and maintain the safety, security, and integrity of our Services;
Comply with or enforce our legal or contractual obligations, resolve disputes, and enforce our Terms of Use and Terms of Sale;
Audit our internal processes for compliance with legal and contractual requirements and internal policies;
Protect our, your, or others’ rights, privacy, safety, or property (including by making and defending legal claims); and
Respond to law enforcement requests and as required or permitted by applicable law, court order, or governmental regulations.
Qualifications & exceptions
Responding to law enforcement is described as "as required or permitted" by law, which includes uses the law permits and does not require.
Not stated here
The Terms of Use and Terms of Sale are separate documents not supplied in this source.
Legal Rights & Agreement Rules · Company practice
Sharing with authorities and private parties for legal compliance
WHOOP says it may share Personal Data with authorities and others, including law enforcement, government authorities and private parties that WHOOP believes in good faith to be necessary or appropriate to comply with the law or legal process. The test is WHOOP's good-faith belief, and recipients can include private parties, not only government bodies.
Supporting quotations
Authorities and others, including law enforcement, government authorities, and private parties we believe in good faith to be necessary or appropriate to comply with the law or legal process;
Qualifications & exceptions
The standard is WHOOP's good-faith belief that sharing is "necessary or appropriate to comply with the law or legal process."
Legal Rights & Agreement Rules · Restriction or exception
Third-party sites and integrations are outside WHOOP's control
The Services may contain links to third-party websites and services, and WHOOP content may be integrated into pages or services not associated with WHOOP. WHOOP says these links and integrations are not an endorsement or a representation that it is affiliated with the third party. WHOOP says it does not control third-party mobile apps, websites or online services and is not responsible for their actions. You can learn about and control how those third parties use and share Personal Data, including with WHOOP, by reviewing their privacy notices and using the privacy choices they offer.
Supporting quotations
We do not control mobile applications, websites, or online services offered or operated by third parties, and we are not responsible for their actions.
You can learn about and control how these third parties use and share Personal Data, including with WHOOP, by reviewing their privacy notices and exercising the privacy choices the third party may offer.
we are responsible for the data protection practices of our data processors
Qualifications & exceptions
The disclaimer covers third-party sites and services that WHOOP does not control; it is separate from WHOOP's own service providers, which the policy says it is responsible for.
Not stated here
The third parties' privacy notices are not supplied here.
Legal Rights & Agreement Rules · Restriction or exception
HIPAA: a covered entity's Notice of Privacy Practices governs when WHOOP acts on its behalf
To the extent WHOOP processes your personal information while providing services on behalf of a "covered entity" under the Health Insurance Portability and Accountability Act, that processing is governed by the relevant covered entity's Notice of Privacy Practices. If the Privacy Policy and that Notice of Privacy Practices conflict, the Notice of Privacy Practices governs.
Supporting quotations
To the extent that we process your personal information in connection with our providing services on behalf of a “covered entity” under the Health Insurance Portability and Accountability Act, our processing of your personal information in that context will be governed by the Notice of Privacy Practices of the relevant covered entity.
In the event of a conflict between our Privacy Policy and the relevant Notice of Privacy Practices, the relevant Notice of Privacy Practices will govern.
Qualifications & exceptions
The rule applies only when WHOOP provides services on behalf of a HIPAA covered entity.
Not stated here
Which WHOOP services, if any, are provided on behalf of a covered entity is not stated here.
The relevant Notices of Privacy Practices are not supplied.
Legal Rights & Agreement Rules · Company practice
WHOOP may change the policy and alerts you to material changes
WHOOP says it may change the Privacy Policy from time to time. Changes will be posted on the WHOOP website and available on other WHOOP Services. WHOOP says it will alert you to material changes by placing a notice on the website, sending an email, and/or by some other means. The text does not give an advance notice period or say that you must accept changes.
Supporting quotations
we may need to change this Privacy Policy from time to time. Changes will be posted on the WHOOP website and available on other WHOOP Services.
We will alert you to material changes by placing a notice on the WHOOP website, by sending you an email, and/or by some other means.
Qualifications & exceptions
Notice of material changes is by one or more of: website notice, email, "and/or by some other means."
Not stated here
No advance notice period or effective-date rule is stated.
Legal Rights & Agreement Rules · Context
U.S. state privacy notice: which residents it addresses
The U.S. State-Specific Privacy Notice says that if you are a resident of California, Colorado, Connecticut, Delaware (as of January 1, 2025), Iowa (as of January 1, 2025), Maryland (as of October 1, 2025), Minnesota (as of July 31, 2025), Montana, Nebraska (as of January 1, 2025), New Hampshire (as of January 1, 2025), New Jersey (as of January 15, 2025), Oregon, Tennessee (as of July 1, 2025), Texas, Utah, or Virginia, the law in your state may provide you with the rights listed. The statement says state law "may" provide these rights; the rights come from the state law that applies to you.
Supporting quotations
If you are a resident of California, Colorado, Connecticut, Delaware (as of January 1, 2025), Iowa (as of January 1, 2025), Maryland (as of October 1, 2025), Minnesota (as of July 31, 2025), Montana, Nebraska (as of January 1, 2025), New Hampshire (as of January 1, 2025), New Jersey (as of January 15, 2025), Oregon, Tennessee (as of July 1, 2025), Texas, Utah, and Virginia, the law in your state may provide you with the following rights:
Qualifications & exceptions
Rights are described as ones state law "may" provide; some states are listed with start dates.
Legal Rights & Agreement Rules · Company commitment
Transfers from the EU to the U.S. rely on Standard Contractual Clauses "in the interim"
Under "16A. New Trans-Atlantic Data Privacy Framework," the policy recounts that the 2020 Schrems II judgment found the Privacy Shield no longer adequate, and that in 2022 the U.S. and the European Commission announced an "agreement in principle" on a new framework. In the interim, to let transfers of personal data from the EU to the U.S. proceed in line with European law, WHOOP says it will enter into the Standard Contractual Clauses with its vendors who process personal data, and with its customers upon request.
Supporting quotations
The US and the European Commission announced in 2022 an “agreement in principle” to develop a new Trans-Atlantic Data Privacy Framework
The judgment in the Schrems II case issued by the European Court of Justice in 2020 found that Privacy Shield framework no longer provides adequate safeguards for the transfer of personal data to the United States from the EEA.
In the interim, to ensure that transfers of personal data from the EU to the US can occur in line with European data protection laws, Whoop will enter into the Standard Contractual Clauses with our vendors who process personal data, and with our customers upon request.
Qualifications & exceptions
The commitment is for transfers of personal data from the EU to the U.S., "in the interim."
The Standard Contractual Clauses are entered into with vendors who process personal data and with customers upon request.
Not stated here
The text does not say whether WHOOP participates in any framework that has since replaced the interim measure; it describes a 2022 announcement.
The Standard Contractual Clauses are not supplied here.
Legal Rights & Agreement Rules · Context
Brazil notice: who it applies to and who the controller is
The Brazil notice applies if you are a Brazilian resident, if your Personal Information was collected in Brazil (for example you were located in Brazil when it was collected), or if the data processing activities are performed in Brazil. WHOOP, Inc. is the controller of Personal Data processed in connection with the Services, at One Kenmore Square, #601, Boston, MA 02215, privacy@whoop.com. The Data Protection Officer entry says "Please see here for information on the DPO," a link whose destination is not part of the saved text.
Supporting quotations
If: (a) you are a Brazilian resident; (b) your Personal Information was collected in Brazil (e.g. you were located in Brazil at the moment that your Personal Information was collected); or (c) the data processing activities are being performed in Brazil, this section is applicable to you.
Whoop, Inc. will be the controller of your Personal Data processed in connection with the Services.
Whoop, Inc., One Kenmore Square, #601 Boston, MA 02215, privacy@whoop.com
Please see here for information on the DPO.
Qualifications & exceptions
The notice applies if any one of the three conditions (residence, collection in Brazil, or processing in Brazil) is met.
Not stated here
The information on the Data Protection Officer is behind a link that is not supplied here.
Legal Rights & Agreement Rules · Company practice
Brazil legal bases for processing
For Brazil, WHOOP says it will only process Personal Data if it has a lawful basis, which can include consent, performance of an agreement and its legitimate interests, depending on the data and context. It lists the bases it typically relies on: service delivery on the necessity to perform its contract or take steps you request (otherwise its legitimate interest in providing what you request); research and development on its legitimate interests; marketing and advertising on your consent where applicable law requires it, otherwise its legitimate interests in promoting its business; and compliance and protection on a legal obligation, vital interests of you or others, or a task carried out in the public interest.
Supporting quotations
We will only process your Personal Data if we have a lawful basis for doing so. Lawful bases for processing include consent, performance of an agreement and our “legitimate interests”
Processing is necessary to perform our contract, or to take steps that you request prior to engaging our Services.
Processing is based on our legitimate interests.
Processing is based on your consent where that consent is required by applicable law.
we may also need to process Personal Data to comply with a legal obligation, if it is necessary to protect the vital interests of you or other data subjects, or if it is necessary for a task carried out in the public interest
Qualifications & exceptions
The bases are those WHOOP "typically" relies on and depend on the type of data and context.
Marketing relies on consent only where the law requires it.
Legal Rights & Agreement Rules · Context
India notice: additional rights and where the policy describes data and purposes
For residents of India, WHOOP says you may have additional rights under applicable data protection laws. The notice says the Privacy Policy lists the description of Personal Data collected in its "Personal Data We Collect" section, and describes the specified purposes for processing in its "How We Use Personal Data" and "How We Share Personal Data" sections.
Supporting quotations
If you reside in India, you may have additional rights under applicable data protection laws.
The Privacy Policy lists down the description of the Personal Data we collect about you in the “Personal Data We Collect ” section above.
Qualifications & exceptions
The additional rights are stated as ones you "may have" under applicable law.
Legal Rights & Agreement Rules · Restriction or exception
India: duties you undertake by using the Services
By using the Services, WHOOP says you represent, warrant and undertake to ensure that Personal Data you provide directly (such as completing your profile) is complete, accurate, consistent and verifiably authentic; that you do not impersonate another person when providing Personal Data; that you do not register any false or frivolous grievance or complaint with WHOOP or the Data Protection Board; and that you comply with laws in force when exercising your rights over your Personal Data.
Supporting quotations
By using our Services, you represent, warrant, and undertake to ensure:
That the Personal Data you provide directly to us (such as when completing your profile) is complete, accurate, consistent and verifiably authentic;
To not impersonate another person while providing Personal Data;
To not register any false or frivolous grievance or complaint with Whoop or the Data Protection Board;
To comply with laws in force when exercising your rights in relation to your Personal Data.
Qualifications & exceptions
These are stated as representations, warranties and undertakings you give by using the Services.
Not stated here
The consequences of breaching these duties are not stated here.
Legal Rights & Agreement Rules · Context
Japan notice: purpose and company representative
The Japan notice is a supplemental privacy notice provided to consumers in Japan under the Act on the Protection of Personal Information (the APPI). It gives the company address as One Kenmore Square, Boston, MA 02215 and says information regarding the representative of the company is available through a link, which is not part of the saved text.
Supporting quotations
We are providing this supplemental privacy notice to consumers in Japan, pursuant to the Act on the Protection of Personal Information (the “APPI”).
Whoop, Inc. is a company registered in One Kenmore Square, Boston, MA 02215. Information regarding the representative of the company is available here.
Not stated here
The representative's identity is behind a link that is not supplied here.
Legal Rights & Agreement Rules · Company practice
Qatar: legal obligation as a ground and more than one ground may apply
In the Qatar notice, besides consent and legitimate interests, WHOOP lists a legal obligation ground: when it needs to comply with a legal or regulatory obligation. It says it may process your Personal Data on more than one ground depending on the reason for using it, and that you can contact privacy@whoop.com for details about the specific grounds relied on for your data. The legitimate interests ground, with the balancing tests WHOOP says it carried out, is described immediately before.
Supporting quotations
You can obtain information on any of our balancing tests by contacting us using the details set out later in this notice.
Legal obligation: When we need to comply with a legal or regulatory obligation.
WHOOP may process your Personal Data on more than one ground depending on the reason or grounds for using your Personal Data. Please contact us at privacy@whoop.com if you need details about the specific grounds we are relying on to process your Personal Data.
Qualifications & exceptions
More than one ground may apply to the same data depending on the reason for use.
Legal Rights & Agreement Rules · Permission or license
Singapore: who the notice applies to, and consent by interacting or signing up
The Singapore notice applies if you are a Singapore resident, your Personal Data was collected in Singapore, or the relevant data processing is performed in Singapore by WHOOP. It also says that by interacting with WHOOP, submitting information to WHOOP, or signing up for any Services, you agree and consent to WHOOP collecting, using and/or disclosing your Personal Data in the manner outlined in the Privacy Policy. This means consent is treated as given through those actions.
Supporting quotations
If: (a) you are a Singapore resident; (b) your Personal Data was collected in Singapore ; or (c) the relevant data processing activities are being performed in Singapore by WHOOP, this section is applicable to you.
By interacting with us, submitting information to us, or signing up for any Services offered by us, you agree and consent to us collecting, using and/or disclosing your Personal Data in the manner outlined in this Privacy Policy.
Qualifications & exceptions
The notice applies if any one of the three conditions is met.
Consent is stated to arise from interacting, submitting information or signing up for any Services.
Not stated here
The text does not say how this deemed consent interacts with the separate consents described elsewhere in the notice, such as for marketing.
Cross-references
contrast (model-proposed): Singapore: marketing with consent, Do Not Call Registry and opt-out — contrast: The Singapore notice says interacting with WHOOP, submitting information or signing up counts as consent to collection, use and disclosure as outlined in the policy, while its marketing paragraph says marketing use is "with your consent" and gives a separate opt-out. The text does not say whether the first consent covers marketing.
Legal Rights & Agreement Rules · Context
South Korea notice: Korean law applies
The South Korea notice says that for Korean data subjects, the Personal Information Protection Act (PIPA) of Korea and other laws and regulations on data privacy in Korea apply.
Supporting quotations
For Korean data subjects, the Personal Information Protection Act (“PIPA”) of Korea and other laws and/or regulations regarding data privacy in Korea apply.
Not stated here
The introduction lists a Taiwan notice, but the saved text has no Taiwan notice; the South Korea notice is the last in the saved text.
Legal Rights & Agreement Rules · Company practice
South Korea: legal bases are consent and contract necessity
In the South Korea notice, WHOOP says it processes Personal Data under two legal bases for the purposes stated in the "How We Use Personal Data" section: your consent (citing Article 15(1)(i) of the Korean Personal Information Protection Act), and necessity to perform a contract with the data subject or to take actions at the data subject's request when entering into a contract (Article 15(1)(iv)). For each basis the notice lists the same items of Personal Data: contract details, profile data, communications, wellness data, conversations, payment and transactional data, marketing data, geolocation data and online activity data.
Supporting quotations
We process your Personal Data pursuant to the following legal bases for the purposes stated in
HOW WE USE PERSONAL DATA of this Privacy Policy.
Your consent (PIPA Article 15(1)(i)) Items of Personal Data we collect: Contract details; profile data; communications; wellness data; conversations; payment and transactional data; marketing data; geolocation data, online activity data
Necessary to perform a contract with a data subject or to take actions at the request of the data subject in the process of entering into a contract (PIPA Article 15(1)(iv))
Items of Personal Data we collect: Contract details; profile data; communications; wellness data; conversations; payment and transactional data; marketing data; geolocation data, online activity data
Qualifications & exceptions
The same list of data items is given for both legal bases.
Not stated here
The text of the cited PIPA articles is not supplied here.
The notice does not map particular purposes to particular legal bases.
Legal Rights & Agreement Rules · Restriction or exception
European notice: GDPR rights and precedence over conflicting provisions
For residents of Europe, WHOOP says you may have additional rights under the General Data Protection Regulation (GDPR) and other European data protection and e-privacy laws. It adds that, to the extent of any conflict between the provisions in "this Section 16" and any other provision of the Privacy Policy, the former control to the extent of the conflict. The saved text does not store section numbers, so "this Section 16" is read as this European notice from the order of the numbered headings and from the policy's own cross-references (see the reference decision); that reading is an inference.
Supporting quotations
If you are a resident of Europe, you may have additional rights under the General Data Protection Regulation (the “GDPR”) and other European data protection and e-privacy laws.
To the extent of any conflict between the provisions set out in this Section 16, and any other provision in this Privacy Policy, the former shall control to the extent of such conflict.
Qualifications & exceptions
The precedence rule applies "to the extent of such conflict," and only for the provisions of the section it names.
"Europe" covers the EEA, the United Kingdom and Switzerland per the policy's introduction.
Not stated here
The number "Section 16" is not stored in the saved text; the reading of it as the European notice is inferred from heading order and cross-references, and a "16A" subsection appears before the European notice heading.
Legal Rights & Agreement Rules · Context
WHOOP, Inc. is the controller; EU and UK representatives
For European residents, WHOOP, Inc. is the controller of Personal Data processed in connection with the Services, with the contact address given as Whoop, Inc., Attn: Data Protection Officer, One Kenmore Square, #601, Boston, MA 02215, privacy@whoop.com. WHOOP names an EU Representative (Whoop Limited, 70 Sir John Rogerson's Quay, Dublin 2, Ireland) and a UK Representative (DP Data Protection Services UK Ltd., 16 Great Queen Street, Covent Garden, London). You may contact any one of the representatives at whoop@gdpr-rep.com.
Supporting quotations
WHOOP, Inc. will be the controller of your Personal Data processed in connection with the Services.
Whoop Limited, 70 Sir John Rogerson’s Quay Dublin 2 Dublin, D02 R296, Ireland
DP Data Protection Services UK Ltd. Attn: Whoop, Inc. 16 Great Queen Street, Covent Garden, London, WC2B 5AH, United Kingdom
You may contact any one of the above representatives at: whoop@gdpr-rep.com
Legal Rights & Agreement Rules · Company practice
Legal bases for processing European residents' Personal Data
WHOOP says it will only process Personal Data if it has a lawful basis, which can include consent, contractual necessity and legitimate interests (its own or others'), depending on the data and context. The bases it typically relies on are: for service delivery, necessity to perform its contract or take steps you request, otherwise its legitimate interest in providing what you request; for research and development, its legitimate interests; for marketing and advertising, your consent where applicable law requires it, otherwise its legitimate interests in promoting its business; and for compliance and protection, a legal obligation, protection of vital interests of you or others, or a task in the public interest.
Supporting quotations
We will only process your Personal Data if we have a lawful basis for doing so. Lawful bases for processing include consent, contractual necessity and our “legitimate interests” or the legitimate interest of others
Processing is necessary to perform our contract, or to take steps that you request prior to engaging our Services.
These activities constitute our legitimate interests.
Processing is based on your consent where that consent is required by applicable law. Where such consent is not required by applicable law, we process your personal information for these purposes based on our legitimate interests in promoting our business.
we may also need to process Personal Data to comply with a legal obligation, if it is necessary to protect the vital interests of you or other data subjects, or if it is necessary for a task carried out in the public interest
Qualifications & exceptions
The bases are described as those WHOOP "typically" relies on and "will depend on the type of Personal Data and the specific context."
Marketing relies on consent only where consent is required by applicable law.
Legal Rights & Agreement Rules · Company practice
Qatar: consent and legitimate interests as grounds for processing
In the Qatar notice, WHOOP says it processes "End User Personal Data" on the grounds of consent and legitimate interests. For sensitive Personal Data, it relies on your explicit consent to the collection and on having obtained appropriate authorization to process it from the supervisory authority. For legitimate interests, it says it has a legitimate business or commercial reason to process your Personal Data and your interests and fundamental rights do not override those interests. WHOOP says it has carried out balancing tests for all data processing based on legitimate interests and that you can obtain information on them by contacting WHOOP using the details set out later in the notice.
Supporting quotations
WHOOP processes End User Personal Data on the following grounds:
Consent: When you have provided your consent. In the case of sensitive Personal Data, when you have provided your explicit consent to our collection of your Personal Data and we have obtained appropriate authorization to process such sensitive Personal Data from the supervisory authority set out above.
Legitimate interests: When WHOOP has a legitimate business or commercial reason to process your Personal Data, and your interests and your fundamental rights do not override those interests. We have carried out balancing tests for all the data processing we carry out on the basis of our legitimate interests. You can obtain information on any of our balancing tests by contacting us using the details set out later in this notice.
Qualifications & exceptions
Sensitive Personal Data requires both your explicit consent and authorization from the supervisory authority.
Legitimate interests apply where your interests and fundamental rights do not override them.
Not stated here
"End User Personal Data" is not defined in this notice.
Legal Rights & Agreement Rules · Context
What this Privacy Policy covers and who is responsible
The policy covers Personal Data WHOOP collects about WHOOP members and other consumers who interact with WHOOP or use its services: websites, social media pages, mobile apps, the WHOOP Strap or another WHOOP device, WHOOP Advanced Labs, and related features, content or applications. It does not cover companies or people WHOOP does not own, control or manage, and WHOOP says it is not responsible for third parties' policies and practices. WHOOP does say it is responsible for the data protection practices of its data processors, under the data protection laws of the place where you live.
Supporting quotations
This Privacy Policy applies to Personal Data we collect about WHOOP members and other consumers who interact with WHOOP or use our services
This Privacy Policy does not cover the practices of companies or people that we do not own, control or manage.
we are responsible for the data protection practices of our data processors
We do not control mobile applications, websites, or online services offered or operated by third parties, and we are not responsible for their actions.
Qualifications & exceptions
"Services" is defined to include the sites, apps, WHOOP Strap or other devices and Advanced Labs, plus related features and content.
Third-party practices are excluded, but WHOOP states responsibility for its own data processors.
Not stated here
Which specific third parties count as outside WHOOP's ownership or control is not listed here.
Legal Rights & Agreement Rules · Context
Regional notices and a separate Consumer Health Data notice
WHOOP adds supplemental notices for residents of certain U.S. states and for people in Europe (the European Economic Area, the United Kingdom and Switzerland), Brazil, India, Israel, Japan, Mexico, Qatar, Singapore, South Africa, South Korea and Taiwan. Separately, because WHOOP may process health-related data that counts as "Consumer Health Data" under U.S. state laws, it has a supplemental Consumer Health Data Privacy Notice with more detail. That notice is a separate document and is not part of this source.
Supporting quotations
We have provided supplemental notices below for residents of certain U.S. states and individuals located in the European Economic Area, the United Kingdom, and Switzerland
we have created a supplemental Consumer Health Data Privacy Notice
Please refer to the WHOOP Consumer Health Data Privacy Notice for more details.
Qualifications & exceptions
The Consumer Health Data Privacy Notice is a separate document; its terms are not supplied here.
The supplemental notices are separate sections; whether each country notice is present in the saved text is addressed where those sections appear.
Not stated here
The content of the Consumer Health Data Privacy Notice is not in this source.
The introduction lists a notice for Taiwan, but the saved text contains no Taiwan notice.