Mobile advertising ID settings and privacy tools can limit tracking
Beyond browser settings, WHOOP says your mobile device may offer settings to make choices about the collection, use or transfer of the advertising ID tied to your device for interest-based advertising. You can also block WHOOP's websites from setting cookies used for interest-based ads by using a browser with privacy features (Brave is named) or by installing and configuring browser plugins such as Privacy Badger, Ghostery or uBlock Origin to block third-party cookies and trackers. To opt out of Google Analytics, WHOOP points to a Google browser plug-in available at a Google address. These are choices you make with tools outside WHOOP.
Supporting quotations
Your mobile devices may offer settings that enable you to make choices about the collection, use, or transfer of your advertising ID associated with your mobile device for interest-based advertising purposes.
You can block our websites from setting Cookies used for interest-based ads by using a browser with privacy features, like Brave, or installing browser plugins like Privacy Badger, Ghostery, or uBlock Origin, and configuring them to block third party Cookies/trackers.
You can also opt out of Google Analytics by downloading and installing the browser plug-in available at: https://tools.google.com/dlpage/gaoptout.
Most browsers let you remove or reject Cookies, including Cookies used for interest-based advertising.
Qualifications & exceptions
The mobile settings are described as something devices "may offer," not a WHOOP control.
The privacy-tool route blocks cookies used for interest-based ads; the Google Analytics opt-out is a separate Google plug-in.
Not stated here
What each named tool blocks is not described.
The Google Analytics opt-out page is not supplied here, so this card cannot say what that plug-in does.
Data Access & Collection · User right or choice
Platform and advertising-industry opt-out tools
WHOOP lists platform opt-out pages for Google (AdWords), Microsoft (Bing) and Facebook, and advertising industry opt-out tools: the Digital Advertising Alliance for websites and for mobile apps, and the Network Advertising Initiative. It says you can use these options to limit use of your information for interest-based advertising by participating companies. The tools reach companies that take part in them.
Supporting quotations
Platform opt-out.
Google (AdWords): adsettings.google.com;
Microsoft (Bing): about.ads.microsoft.com/en-us/resources/policies/personalized-ads; and
Facebook: www.facebook.com/about/ads.
Advertising industry opt-out tools.
Digital Advertising Alliance for Websites: https://optout.aboutads.info;
Digital Advertising Alliance for Mobile Apps: https://youradchoices.com/appchoices; and
You can also use these opt-out options to limit use of your information for interest-based advertising by participating companies:
Qualifications & exceptions
The industry opt-outs apply to participating companies only.
Not stated here
Which advertising partners participate in these programs is not listed.
The linked opt-out pages (Google, Microsoft, Facebook, the Digital Advertising Alliance and the Network Advertising Initiative) are not supplied here, so this card cannot say what each tool does.
Data Access & Collection · Restriction or exception
Opt-outs are cookie-based and do not stop all ads
Some opt-out features are cookie-based: using them places an "opt-out" cookie on your device saying you do not want interest-based advertising from certain companies. If you delete your cookies, use a different browser or use a different device, you will need to renew your opt-out. Opting out of interest-based advertising does not mean you will stop receiving online ads; it only means the ads will no longer be tailored to your viewing habits or interests, and you may continue to see ads on and about the Services.
Supporting quotations
If you delete your Cookies, use a different browser, or use a different device, you will need to renew your opt-out choice.
Opting out of interest-based advertising does not mean that you will no longer receive online ads. It only means that such ads will no longer be tailored to your specific viewing habits or interests.
Qualifications & exceptions
Cookie-based opt-outs apply per browser and device and must be renewed after cookies are deleted.
Opting out changes ad tailoring, not whether ads appear.
Use & Processing · Company practice
Service delivery uses of Personal Data
WHOOP says it processes and uses Personal Data for service delivery, including to provide, operate, improve, develop, understand and personalize the Services and its business (including testing, research, analysis and product development); satisfy the reason you gave the information (delivering the Services and responding to requests); communicate with you about the Services, including announcements, updates or offers; provide support; create and manage accounts or profiles; customize website content and communications based on your preferences; and process orders, memberships or other transactions. "Including" and the broad verbs mean the list is not a narrow limit on what the Services and the business cover.
Supporting quotations
We process and use Personal Data for the following purposes:
Provide, operate, improve, develop, understand, and personalize the Services and our business, including testing, research, analysis, and product development;
Satisfy the reason you provided the information to us, including for delivery of the Services and responding to and fulfilling requests;
Communicate with you about the Services, including Service announcements, updates, or offers;
Provide support and assistance for the Services;
Create and manage your account or other user profiles;
Customize website content and communications based on your preferences; and
Process orders, memberships, or other transactions.
Qualifications & exceptions
The first item covers improving and developing the Services and WHOOP's business, including research and product development.
Communications about the Services can include offers.
Use & Processing · Company practice
Research and development uses aggregated or de-identified data
WHOOP says it may create and use aggregated or de-identified data from the Personal Data it collects, for business improvement: analyzing the effectiveness of the Services, improving and adding features, and analyzing the general behavior and characteristics of users. It also says it uses de-identified wellness data for research purposes to help WHOOP and its research partners answer questions about human performance and to identify insights and provide new content and product features. The research use is described for de-identified wellness data, not identifiable data.
Supporting quotations
We may create and use aggregated data or de-identified Data from Personal Data we collect, for business improvement purposes
We also use de-identified wellness data for research purposes to help us and our research partners answer important questions about human performance
Qualifications & exceptions
The research use is stated for de-identified wellness data, shared with research partners as a purpose.
"De-identified" is not defined in this paragraph.
Not stated here
What de-identification method is used, and who the research partners are, is not stated here.
Use & Processing · Company practice
Direct marketing and advertising, with consent where required for consumer health data
WHOOP says it may use data from the Personal Data it collects, and certain data collected when you browse its website, to send you direct offers or other marketing messages or to advertise the Services or other WHOOP product offerings. A qualification elsewhere in the policy says WHOOP will obtain consent where required by applicable law before using consumer health data for marketing or promotional purposes, and that you can opt out of that use at any time.
Supporting quotations
We may use data from the Personal Data we collect and certain data collected when you browse our website, to send you direct offers or other marketing messages or to advertise the Services or other WHOOP product offerings.
We will obtain consent where required by applicable law before using consumer health data for marketing or promotional purposes. You can opt out of this use at any time.
Qualifications & exceptions
The consumer health data qualification applies to consumer health data and only "where required by applicable law."
Sharing & Disclosure · Company practice
Interest-based advertising through advertising partners
WHOOP says it engages advertising partners, including third-party advertising companies and social media companies, to advertise its Services. WHOOP and those partners may use cookies and similar technologies to collect information about your interaction over time across the web, WHOOP's communications and other online services, and may use that information to serve online ads. WHOOP states that it complies with the Digital Advertising Alliance Self-Regulatory Principles for Online Behavioral Advertising and points to its "Online tracking opt-outs" section for choices. Third parties may place their own cookies on your devices.
Supporting quotations
We engage our advertising partners, including third party advertising companies and social media companies, to advertise our Services.
We and our advertising partners may use Cookies and similar technologies to collect information about your interaction over time across the web, our communications, and other online services, and may use that information to serve online ads.
We comply with the Digital Advertising Alliance Self-Regulatory Principles for Online Behavioral Advertising.
including third parties that have placed their own Cookies on your device(s)
Qualifications & exceptions
The collection described covers interaction over time across the web, not only WHOOP's own site.
The compliance statement refers to an industry self-regulatory program.
Legal Rights & Agreement Rules · Company practice
Compliance and protection uses
WHOOP says it uses Personal Data for compliance and protection, including to protect against or deter fraudulent, illegal or harmful actions and maintain safety, security and integrity; comply with or enforce legal or contractual obligations, resolve disputes, and enforce its Terms of Use and Terms of Sale; audit internal processes for compliance with legal and contractual requirements and internal policies; protect WHOOP's, your or others' rights, privacy, safety or property (including by making and defending legal claims); and respond to law enforcement requests and as required or permitted by applicable law, court order or governmental regulations.
Supporting quotations
Compliance and protection, including to:
Protect against or deter fraudulent, illegal, or harmful actions and maintain the safety, security, and integrity of our Services;
Comply with or enforce our legal or contractual obligations, resolve disputes, and enforce our Terms of Use and Terms of Sale;
Audit our internal processes for compliance with legal and contractual requirements and internal policies;
Protect our, your, or others’ rights, privacy, safety, or property (including by making and defending legal claims); and
Respond to law enforcement requests and as required or permitted by applicable law, court order, or governmental regulations.
Qualifications & exceptions
Responding to law enforcement is described as "as required or permitted" by law, which includes uses the law permits and does not require.
Not stated here
The Terms of Use and Terms of Sale are separate documents not supplied in this source.
Sharing & Disclosure · Company practice
Sharing with service providers, including the AI partner behind WHOOP Coach
WHOOP says it may share your Personal Data with service providers that provide services to it or on its behalf. The examples named are payment processors, vendors who advertise WHOOP's Services or other products, security and fraud prevention consultants, hosting and other technology and communications providers, its third-party large language model ("LLM") partner that powers WHOOP Coach (described in Section 8), analytics providers, and staff augmentation and contract personnel. "Such as" means the list is illustrative, and the policy does not name the providers in this part.
Supporting quotations
We may share your Personal Data with:
Service providers, such as payment processors, vendors who advertise our Services or other WHOOP products, security and fraud prevention consultants, hosting and other technology and communications providers, our third-party Large Language Model (“LLM”) partner that powers WHOOP Coach (as described in Section 8 below), analytics providers, and staff augmentation and contract personnel, that provide services to us or on our behalf;
Qualifications & exceptions
The list is introduced with "such as," so these are examples of service providers, not an exhaustive list.
Service providers are those that "provide services to us or on our behalf."
Not stated here
The providers are not named in this section.
What data each kind of provider receives is not stated here.
Sharing & Disclosure · Company practice
Advertising partners can collect information through cookies; WHOOP says it does not sell Personal Data
WHOOP says it may share your Personal Data with advertising partners that may collect information on its website through cookies and other automated technologies, including for the interest-based advertising purposes described earlier. In its California paragraph WHOOP says that in the 12 months before the policy date it did not sell any Personal Data, that it does not sell Personal Data, and that it only shared Personal Data as described in the policy.
Supporting quotations
Advertising partners that may collect information on our website through Cookies and other automated technologies, including for the interest-based advertising purposes described above.
For the 12-month period prior to the date of this Privacy Policy, WHOOP has not sold any Personal Data. We do not sell Personal Data.
We and our advertising partners may use Cookies and similar technologies to collect information about your interaction over time across the web
including third parties that have placed their own Cookies on your device(s)
Qualifications & exceptions
The advertising partners collect information through cookies and automated technologies on the website.
The no-sale statement is given for the 12-month period before the policy date and in the present tense.
Not stated here
Whether sharing through cookies counts as a "sale" or "share" under each state law is for those laws; this policy states only that it does not sell Personal Data.
Sharing & Disclosure · Company practice
Laboratory and health provider partners receive data when you join Advanced Labs
WHOOP says it may share your Personal Data with third-party laboratory or health provider partners when you choose to participate in WHOOP Advanced Labs. In the section on sharing you control, WHOOP adds that if you choose to participate, it may share your Personal Data with those third parties subject to your explicit consent.
Supporting quotations
Third-party laboratory or health provider partners, when you choose to participate in WHOOP Advanced Labs;
If you choose to participate in WHOOP Advanced Labs, we may share your Personal Data with such third-parties subject to your explicit consent.
Qualifications & exceptions
Sharing is tied to your choice to participate in WHOOP Advanced Labs and, per the later statement, subject to your explicit consent.
Not stated here
The laboratory and provider partners are not named, and which data is shared is not specified.
Sharing & Disclosure · Company practice
Sharing with professional advisors, distributors and retailers, and affiliates
WHOOP says it may share your Personal Data with professional advisors such as lawyers, auditors, bankers and insurers, where necessary in the course of the professional services they provide to WHOOP; with distributors and retailers of its Services or other WHOOP products; and with affiliates of WHOOP. The advisor item is limited to where the sharing is necessary for their professional services; the distributor, retailer and affiliate items state no purpose limit.
Supporting quotations
Professional advisors, such as lawyers, auditors, bankers, and insurers, where necessary in the course of the professional services they render to us;
Distributors and retailers of our Services or other WHOOP products; and
Affiliates of WHOOP.
Qualifications & exceptions
Advisor sharing is limited to what is "necessary in the course of the professional services they render to us."
Not stated here
No purpose or data limit is stated for sharing with distributors, retailers or affiliates.
Legal Rights & Agreement Rules · Company practice
Sharing with authorities and private parties for legal compliance
WHOOP says it may share Personal Data with authorities and others, including law enforcement, government authorities and private parties that WHOOP believes in good faith to be necessary or appropriate to comply with the law or legal process. The test is WHOOP's good-faith belief, and recipients can include private parties, not only government bodies.
Supporting quotations
Authorities and others, including law enforcement, government authorities, and private parties we believe in good faith to be necessary or appropriate to comply with the law or legal process;
Qualifications & exceptions
The standard is WHOOP's good-faith belief that sharing is "necessary or appropriate to comply with the law or legal process."
Sharing & Disclosure · Company practice
Business transfers can include your Personal Data
WHOOP says it may share Personal Data with business transferees, such as acquirers and other participants in business transactions, or in diligence or negotiations for them, involving a divestiture, merger, consolidation, acquisition, reorganization, sale or other disposition of all or any part of the business, assets or equity of WHOOP or its affiliates, including in a bankruptcy or similar proceeding. Sharing can occur at the diligence or negotiation stage, before a transaction is completed.
Supporting quotations
Business transferees, such as acquirers and other relevant participants in business transactions (or diligence or negotiations for such transactions) involving a corporate divestiture, merger, consolidation, acquisition, reorganization, sale, or other disposition of all or any portion of the business or assets of, or equity interests in, WHOOP or our affiliates (including, in connection with a bankruptcy or similar proceedings);
Qualifications & exceptions
Sharing may occur "diligence or negotiations for such transactions," not only after a deal closes.
Not stated here
The policy does not say what happens to your Personal Data or what choices you have after a transfer.
Sharing & Disclosure · Company practice
WHOOP Live and WHOOP Teams: other users, searchability and public visibility
Depending on how you use the Services, you may share Personal Data with other users of the Services or the general public, such as through the WHOOP Live or WHOOP Teams features, which let you choose to share information and content with other users. Users are by default searchable by other users. When you make Personal Data visible to other users, including through WHOOP Live or WHOOP Teams, it may become publicly available and can be collected, viewed and used by anyone.
Supporting quotations
Depending on how you use the Services, you may share Personal Data with:
users are by default searchable by other users
When you make Personal Data visible to other users of the Services, including through the WHOOP Live or WHOOP Teams features, it may become publicly available and can be collected, viewed, and used by anyone;
Qualifications & exceptions
Sharing through these features is something you choose, but users are by default searchable by other users.
Once visible to other users, data "may become publicly available" and can be collected, viewed and used by anyone.
Not stated here
The text does not say which fields are visible in search by default.
Sharing & Disclosure · User right or choice
Linked social media and third-party accounts
You may share Personal Data with third-party social media platforms, or linked accounts, devices or features, when you choose to connect your account on those services with your WHOOP account or post content to social media, such as through the WHOOP Live feature.
Supporting quotations
Third-party social media platforms, or linked accounts, devices, or features, when you choose to connect your account on those services with your WHOOP account or post content to social media, such as through the WHOOP Live feature;
Qualifications & exceptions
Sharing occurs when you choose to connect an account or post content.
Sharing & Disclosure · Company practice
Managing entities and corporate wellness programs
If you use the Services on behalf of, or managed by, a managing entity such as a coach, team, organizing body or other affiliated entity, your account information and Personal Data may be shared with that entity subject to your consent. The text also says "you hereby consent to that managing entity allowing that information to be publicly shared, subject to any features of the Services that expressly override that control," and that the managing entity determines how the information and content are shared. If you use the Services with an employer or organizational corporate wellness program, WHOOP may share your information with that organization subject to your consent, and typically shares only aggregated data with these organizations.
Supporting quotations
your account information and Personal Data may be shared with the managing entity subject to your consent, and you hereby consent to that managing entity allowing that information to be publicly shared, subject to any features of the Services that expressly override that control. The managing entity will determine how the relevant information and content is shared
we may share your information with that organization subject to your consent. Typically, we will share only aggregated data with these organizations.
Qualifications & exceptions
Sharing with a managing entity is "subject to your consent," and the same item states you consent to the entity allowing public sharing.
The managing entity determines how information is shared, except where a Service feature expressly overrides that control.
For corporate wellness programs the policy says WHOOP "typically" shares only aggregated data.
Not stated here
"Typically" leaves open when non-aggregated data could be shared with an employer or organization.
Use & Processing · Company practice
WHOOP Coach is a generative AI feature that uses your WHOOP metrics
WHOOP Coach is described as a generative AI feature intended to help you set goals and make progress, understand WHOOP concepts, provide educational guidance and integrate with the rest of your WHOOP experience. It combines your WHOOP metrics, such as strain, recovery or sleep scores, with the science of WHOOP. It uses third-party AI technology from WHOOP's LLM partner; responses are based on your prompts and relevant information collected through your WHOOP metrics. WHOOP gives an example in which a sleep question is answered with tips based on your de-identified sleep data.
Supporting quotations
WHOOP Coach is a generative AI feature that is intended to help you set and make progress toward your goals, understand WHOOP concepts, provide educational guidance, and integrate with the rest of your WHOOP experience.
WHOOP Coach creates a coaching experience by combining your WHOOP metrics, such as your strain, recovery, or sleep scores, with the science of WHOOP
Please note that WHOOP Coach leverages third-party AI technology provided by our LLM partner. Responses from WHOOP Coach are based on your prompts and relevant information collected through your WHOOP metrics.
Qualifications & exceptions
Responses use your prompts and relevant information from your WHOOP metrics.
The example describes the sleep data used as de-identified.
Not stated here
The LLM partner is not named in this section.
Sharing & Disclosure · Company commitment
The AI partner receives only de-identified metrics and is bound by a zero-retention, zero-training policy
WHOOP says it requires its LLM partner to use your WHOOP metrics strictly to allow WHOOP Coach to generate content for you, and that it has ensured the partner has a "Zero-Retention/Zero Training Policy" for your WHOOP metrics, meaning the partner will not store or retain any of your Personal Data or use any WHOOP metrics to train algorithms or LLM technology. WHOOP also says it will only share de-identified WHOOP metrics with the partner and asks you not to provide identifying information, such as your name, in conversations with WHOOP Coach.
Supporting quotations
We require our LLM partner to use your WHOOP metrics strictly to allow WHOOP Coach to generate content for you.
our LLM partner will not store or retain any of your Personal Data nor use any WHOOP metrics for training any algorithms or LLM technology
We will only share de-identified WHOOP metrics with our LLM partner. Please do not provide any identifying information, such as your name, in conversations with WHOOP Coach.
Qualifications & exceptions
The zero-retention and zero-training description is stated about WHOOP metrics and WHOOP's arrangement with its partner.
The request not to type identifying information in Coach conversations puts that part on you; conversations are also described elsewhere as retained by WHOOP.
Not stated here
The partner's own terms are not supplied, so the policy text cannot show how the arrangement is enforced.
The text does not say what protections apply to identifying information you type into a conversation.
Cross-references
contrast (model-proposed): WHOOP may keep Coach conversation history, share context with the AI partner, and you can delete it — contrast: WHOOP says its LLM partner will not store or retain any of your Personal Data, while also saying WHOOP may retain Coach conversation history and share the context of earlier conversations with that partner when you revisit topics. The text does not reconcile the two, so the reader should treat the partner's handling of earlier conversation context as unclear.
Retention & Deletion · User right or choice
WHOOP may keep Coach conversation history, share context with the AI partner, and you can delete it
WHOOP says it may retain the history of your conversations with WHOOP Coach so you continue to have access to previous conversations. When you revisit earlier topics, WHOOP may share the context of previous conversations with its LLM partner. You may delete your WHOOP Coach chat data at any time, either from the chat history in WHOOP Coach (swipe left on conversations to delete) or by submitting a request to Membership Services.
Supporting quotations
WHOOP may retain the history of your conversations with WHOOP Coach to ensure you continue to have access to previous conversations while using the feature.
When you revisit any topics from previous chats, WHOOP may share the context of your previous conversations with our LLM partner to create a better experience for you.
You may delete your WHOOP Coach chat data at any time by either tapping the chat icon in WHOOP Coach to view your conversation history and swipe left on conversations you would like to delete or by submitting a request to Membership Services to delete your data.
Qualifications & exceptions
Retention is described as "may retain," tied to keeping access to earlier conversations.
Sharing of earlier conversation context with the LLM partner occurs when you revisit topics.
Not stated here
No retention period for Coach chat data is stated in this section.
The text does not say whether deleting chat data removes data the LLM partner or WHOOP holds elsewhere.
Use & Processing · Company practice
WHOOP employee access and support requests from WHOOP Coach
WHOOP says that, consistent with its Privacy Principles, its employees will only access your Personal Data when required to provide services and support. This may include collecting information about your experience with WHOOP Coach, and (in the Membership Services AI paragraph) your experience with Membership Services, to assess performance and improve those features and other product offerings. If WHOOP Coach suggests connecting to Membership Services, you can opt in to have your support request automatically filed with the team, and the support team will then only have access to that specific conversation.
Supporting quotations
WHOOP employees will only access your Personal Data when required to provide services and support. This may include collecting information about your experience with WHOOP Coach to assess the performance of and improve WHOOP Coach and other product offerings.
you can opt in to have your support request automatically filed with our team. In this case, our support team will only have access to that specific conversation to provide you with the best support.
WHOOP employees will only access member Personal Data when required to provide services and support, which may include collecting information about your experience with Membership Services to assess the performance of and improve Membership Services AI and other product offerings.
Qualifications & exceptions
Employee access is stated as limited to when it is "required to provide services and support," but that purpose is defined to include assessing and improving the AI features and other product offerings.
Automatic filing of a support request is something you opt in to, and access is limited to that conversation.
Not stated here
The Privacy Principles are a separate document and are not supplied here.
Use & Processing · Company practice
Membership Services AI answers using your prompts and membership information
WHOOP Membership Services includes a generative AI feature intended to help you get member support. It uses third-party AI technology from WHOOP's LLM partner. Responses are based on your prompts and relevant information collected through your WHOOP membership; for example, a question about your order will draw on your purchase records.
Supporting quotations
WHOOP Membership Service includes a generative AI feature that is intended to assist you in receiving member support.
Membership Services uses third-party AI technology provided by our LLM partner. Responses from Membership Services are based on your prompts and relevant information collected through your WHOOP membership.
if you ask Membership Services a question regarding your order, Membership Services will draw on your purchase records.
Qualifications & exceptions
Responses use "relevant information collected through your WHOOP membership," including purchase records for order questions.
Not stated here
The text does not say whether purchase records or other membership information are sent to the LLM partner, or only the de-identified WHOOP metrics described in the next paragraph.
Sharing & Disclosure · Company commitment
Membership Services AI: the AI partner gets only de-identified metrics under a zero-retention, zero-training policy
For Membership Services AI, WHOOP says it requires its LLM partner to use your WHOOP metrics only to let Membership Services AI generate content for you. It says the partner has a "Zero-Retention/Zero Training Policy" for your WHOOP metrics, meaning the partner will not store or retain any WHOOP metrics it receives through your use of Membership Services and will not use any of them to train algorithms or LLM technology. WHOOP says it will only share de-identified WHOOP metrics with the partner. These statements are about WHOOP metrics; the text does not mention other information such as prompts or purchase records.
Supporting quotations
We require our LLM partner to use your WHOOP metrics only for the purpose of allowing Membership Services AI to generate content for you.
our LLM partner will not store or retain any of the WHOOP metrics they receive through your use of Membership Services, and our LLM partner will not use any of the WHOOP metrics they receive for training any algorithms or LLM technology
We will only share de-identified WHOOP metrics with our LLM partner.
Qualifications & exceptions
The retention and training statements are limited to "WHOOP metrics" the partner receives through Membership Services.
Not stated here
The partner's own terms are not supplied.
The text does not say whether the partner stores or trains on your prompts or purchase records.
Retention & Deletion · Company practice
Membership Services conversation history may be kept and reused
WHOOP says it may retain the history of your conversations with Membership Services so you continue to have access to previous conversations while using the feature. When you revisit earlier topics, WHOOP may share the context of previous conversations "with Membership Services" to create a better experience. For WHOOP Coach, the policy says the context may be shared with the LLM partner and that you can delete chat data; this paragraph for Membership Services states no retention period and no deletion method.
Supporting quotations
WHOOP may retain the history of your conversations with Membership Services to ensure you continue to have access to previous conversations while using the feature.
When you revisit any topics from previous chats, WHOOP may share the context of your previous conversations with Membership Services to create a better experience for you.
You may delete your WHOOP Coach chat data at any time
Qualifications & exceptions
Retention is stated as "may retain," tied to keeping access to previous conversations.
Not stated here
No retention period or deletion method is stated for Membership Services conversation history in this paragraph.
The paragraph says context may be shared "with Membership Services"; it does not say whether that reaches the LLM partner.
Account & Service Control · User right or choice
Access, edit and delete your information; some copies are kept
When you log in you may access, and in some cases edit or delete, certain information you gave WHOOP, such as name, username and password, email and mailing address and other profile information. When you update information, WHOOP may keep a copy of the unrevised information in its records. You may request access to or a full deletion of your account and corresponding data by contacting privacy@whoop.com or using the "Data Management" feature in the WHOOP Privacy Center. You will be asked to complete a verification form to show you have authority. WHOOP says it may need to retain certain Personal Data after you update or delete it, as well as aggregated or de-identified data derived from or incorporating your Personal Data that does not identify you.
Supporting quotations
you may access, and, in some cases, edit or delete certain information you’ve provided to us
When you update information, however, we may maintain a copy of the unrevised information in our records.
You may request access to or a full deletion of your account and corresponding data by contacting privacy@whoop.com or via the “Data Management” feature available in the WHOOP Privacy Center privacy.whoop.com.
You will be asked to complete a verification form in connection with such access or deletion request in order to ensure that you have the authority to access or delete your account.
We may need to retain certain Personal Data in our records, as well as aggregated data or de-identified data derived from or incorporating your Personal Data that does not identify you after you update or delete it.
Qualifications & exceptions
Self-service editing and deleting applies to "certain" information, "in some cases."
Deletion requests require completing a verification form.
Deletion is not complete: WHOOP "may need to retain certain Personal Data," plus aggregated or de-identified derived data.
Not stated here
Which Personal Data WHOOP retains after deletion, and for how long, is not specified here.
Account & Service Control · User right or choice
Privacy settings control whether you are searchable
You can change certain privacy settings in the WHOOP mobile app, including whether you are searchable on WHOOP by your name or username. In Settings on the Main Menu page, choose "Privacy" to make yourself private or searchable. This connects to the earlier statement that users are by default searchable by other users.
Supporting quotations
You can change certain privacy settings, such as whether you are searchable on WHOOP by your name or username
select “Privacy,” where you can choose to make yourself private or searchable.
Qualifications & exceptions
The setting is described for the WHOOP mobile application.
Personalization settings control use of health data for personalization
You can control how your health data is used to personalize your WHOOP experience in the WHOOP app's Privacy Settings. Depending on your location, WHOOP may ask for your permission before using certain types of data for personalization. You can update your preference at any time. If you turn the setting off, WHOOP says it will no longer use your health data to personalize recommendations, offers or similar features within WHOOP, which may affect certain features of the Services.
Supporting quotations
You can control how your health data is used to personalize your WHOOP experience in the WHOOP app in Privacy Settings.
Depending on your location, we may ask for your permission before using certain types of data for personalization.
If you turn this setting off, we will no longer use your health data to personalize recommendations, offers, or similar features within WHOOP, which may affect certain features of the Services.
Qualifications & exceptions
Permission requests depend on your location.
Turning the setting off may affect certain features of the Services.
Not stated here
Which locations trigger a permission request, and which data types, are not specified here.
Data Access & Collection · User right or choice
Device settings: notifications, location and unpairing your WHOOP device
You can change push notification and device permission settings through your mobile device settings. You may allow or disallow location collection by turning location services on or off on your device; if you decline, WHOOP says it cannot provide certain Services, capabilities or features. You can disable collection of "certain wellness data" by un-pairing your WHOOP device from your mobile device; if you unpair, WHOOP says it cannot provide certain Services, capabilities or features.
Supporting quotations
You can change your settings related to push notifications and device permissions through the settings on your mobile device.
You may allow or disallow WHOOP to collect geolocation data by enabling or disabling location services on your mobile device. If you decline to grant WHOOP access to this data, we will not be able to provide certain Services, capabilities, or features to you.
You can disable collection of certain wellness data by un-pairing your WHOOP device from your mobile device. If you unpair your WHOOP device from your mobile device, we will not be able to provide certain Services, capabilities, or features to you.
Qualifications & exceptions
Unpairing disables collection of "certain" wellness data, not necessarily all data.
Declining location access or unpairing means certain Services, capabilities or features may be unavailable.
Not stated here
Which wellness data continues to be collected after unpairing, and which features are lost, is not specified.
Sharing & Disclosure · User right or choice
Leave a WHOOP Team to stop sharing with team members
If you have joined a WHOOP Team, you may stop the sharing of your Personal Data with the members of the WHOOP Team at any time by opening the WHOOP mobile app, going to the Team view, opening the Team menu and selecting "Leave Team."
Supporting quotations
If you have joined a WHOOP Team, you may stop the sharing of your Personal Data with the members of the WHOOP Team at any time by accessing your WHOOP mobile application, navigating to the Team view, opening the Team menu, and selecting “Leave Team”.
Qualifications & exceptions
The step applies to sharing with Team members, and it is done in the mobile application.
Account & Service Control · User right or choice
Marketing email opt-out, with some non-marketing emails not optional
You can opt out of marketing-related emails and other communications through the "Data Management" feature in the WHOOP Privacy Center or by following the opt-out or unsubscribe instructions in the marketing message. You cannot opt out of receiving certain non-marketing emails regarding the Services.
Supporting quotations
You can opt-out of marketing-related emails and other communications by going to our “Data Management” feature available in the WHOOP Privacy Center privacy.whoop.com, or by following the opt-out or unsubscribe instructions contained in the marketing-related message.
You cannot opt-out of receiving certain non-marketing emails regarding the Services.
Qualifications & exceptions
Certain non-marketing emails about the Services cannot be opted out of.
Not stated here
Which non-marketing emails cannot be stopped is not specified.
Data Access & Collection · Company practice
Do Not Track signals are not supported
Some browsers can send "Do Not Track" signals, but WHOOP says the Services do not currently support Do Not Track requests or similar signals. For opting out of certain interest-based advertising and other online tracking, the policy points back to its "Online tracking opt-outs" section, which describes ways to opt out of certain interest-based advertising and tracking activities.
Supporting quotations
The Services do not currently support “Do Not Track” requests or similar signals.
There are a number of ways you can opt-out of certain interest-based advertising and other online tracking activities
There are a number of ways you can opt out of certain interest-based advertising and other online tracking activities, which we have summarized below.
Qualifications & exceptions
The statement is made in the present tense ("do not currently support").
The opt-outs referred to cover "certain" interest-based advertising and tracking.
Legal Rights & Agreement Rules · Restriction or exception
Third-party sites and integrations are outside WHOOP's control
The Services may contain links to third-party websites and services, and WHOOP content may be integrated into pages or services not associated with WHOOP. WHOOP says these links and integrations are not an endorsement or a representation that it is affiliated with the third party. WHOOP says it does not control third-party mobile apps, websites or online services and is not responsible for their actions. You can learn about and control how those third parties use and share Personal Data, including with WHOOP, by reviewing their privacy notices and using the privacy choices they offer.
Supporting quotations
We do not control mobile applications, websites, or online services offered or operated by third parties, and we are not responsible for their actions.
You can learn about and control how these third parties use and share Personal Data, including with WHOOP, by reviewing their privacy notices and exercising the privacy choices the third party may offer.
we are responsible for the data protection practices of our data processors
Qualifications & exceptions
The disclaimer covers third-party sites and services that WHOOP does not control; it is separate from WHOOP's own service providers, which the policy says it is responsible for.
Not stated here
The third parties' privacy notices are not supplied here.
Legal Rights & Agreement Rules · Restriction or exception
HIPAA: a covered entity's Notice of Privacy Practices governs when WHOOP acts on its behalf
To the extent WHOOP processes your personal information while providing services on behalf of a "covered entity" under the Health Insurance Portability and Accountability Act, that processing is governed by the relevant covered entity's Notice of Privacy Practices. If the Privacy Policy and that Notice of Privacy Practices conflict, the Notice of Privacy Practices governs.
Supporting quotations
To the extent that we process your personal information in connection with our providing services on behalf of a “covered entity” under the Health Insurance Portability and Accountability Act, our processing of your personal information in that context will be governed by the Notice of Privacy Practices of the relevant covered entity.
In the event of a conflict between our Privacy Policy and the relevant Notice of Privacy Practices, the relevant Notice of Privacy Practices will govern.
Qualifications & exceptions
The rule applies only when WHOOP provides services on behalf of a HIPAA covered entity.
Not stated here
Which WHOOP services, if any, are provided on behalf of a covered entity is not stated here.
The relevant Notices of Privacy Practices are not supplied.
Security & Safeguards · Company commitment
Security measures with no guarantee
WHOOP says it uses physical, technical, organizational and administrative security measures designed to protect the Personal Data it collects. It also says no security measures are failsafe and that it cannot guarantee the security of your Personal Data.
Supporting quotations
We employ a number of physical, technical, organizational, and administrative security measures designed to protect the Personal Data we collect.
no security measures are failsafe, and we cannot guarantee the security of your Personal Data
Qualifications & exceptions
The measures are "designed to protect" Personal Data; WHOOP disclaims any guarantee.
Not stated here
The specific measures are not described.
Retention & Deletion · Company practice
Personal Data is kept as long as reasonably necessary, a business need exists, or the law requires
WHOOP says it retains Personal Data for as long as reasonably necessary for the purposes described in the policy, while it has a business need to do so, or as required by law (for example for tax, legal or accounting purposes), whichever is longer. "Whichever is longer" means the longest of those periods applies. The retention clause sets no fixed period.
Supporting quotations
We retain Personal Data for as long as reasonably necessary for the purposes described in this Privacy Policy, while we have a business need to do so, or as required by law (e.g., for tax, legal, accounting, or other purposes), whichever is longer.
Qualifications & exceptions
The longest of three periods applies: reasonably necessary for the described purposes, a continuing business need, or a legal requirement.
Not stated here
No specific retention period is stated for any category of Personal Data in this clause.
Data Access & Collection · Company commitment
Children: no registration under the age to consent; deletion if WHOOP learns of it
If you are under the age to consent to data sharing in your jurisdiction, WHOOP asks you not to register for the Services or send it Personal Data about yourself. If WHOOP learns it has collected Personal Data from a child under that age, it says it will delete the information as quickly as possible. If you believe a child may have provided WHOOP Personal Data, you can contact privacy@whoop.com. The policy does not state a specific age.
Supporting quotations
If you are under the age to consent to data sharing, as applicable based on your jurisdiction, please do not attempt to register for the Services or send any Personal Data about yourself to us.
If we learn that we have collected Personal Data from a child under the age to consent to data sharing, as applicable based on jurisdiction, we will delete that information as quickly as possible.
please contact us at privacy@whoop.com
Qualifications & exceptions
The age threshold is "the age to consent to data sharing, as applicable based on your jurisdiction."
Deletion is triggered when WHOOP "learns" it has collected data from a child.
Not stated here
No specific age is stated in this section.
Legal Rights & Agreement Rules · Company practice
WHOOP may change the policy and alerts you to material changes
WHOOP says it may change the Privacy Policy from time to time. Changes will be posted on the WHOOP website and available on other WHOOP Services. WHOOP says it will alert you to material changes by placing a notice on the website, sending an email, and/or by some other means. The text does not give an advance notice period or say that you must accept changes.
Supporting quotations
we may need to change this Privacy Policy from time to time. Changes will be posted on the WHOOP website and available on other WHOOP Services.
We will alert you to material changes by placing a notice on the WHOOP website, by sending you an email, and/or by some other means.
Qualifications & exceptions
Notice of material changes is by one or more of: website notice, email, "and/or by some other means."
Not stated here
No advance notice period or effective-date rule is stated.
Account & Service Control · Procedure
How to contact WHOOP about privacy
For questions or concerns about WHOOP's privacy policies, you can send a detailed message to privacy@whoop.com or write to Whoop, Inc., Attn: Legal Department, One Kenmore Square, #601, Boston, MA 02215.
Supporting quotations
please send us a detailed message to privacy@whoop.com or at the mailing address below
Whoop, Inc., Attn: Legal Department, One Kenmore Square, #601 Boston, MA 02215
Legal Rights & Agreement Rules · Context
U.S. state privacy notice: which residents it addresses
The U.S. State-Specific Privacy Notice says that if you are a resident of California, Colorado, Connecticut, Delaware (as of January 1, 2025), Iowa (as of January 1, 2025), Maryland (as of October 1, 2025), Minnesota (as of July 31, 2025), Montana, Nebraska (as of January 1, 2025), New Hampshire (as of January 1, 2025), New Jersey (as of January 15, 2025), Oregon, Tennessee (as of July 1, 2025), Texas, Utah, or Virginia, the law in your state may provide you with the rights listed. The statement says state law "may" provide these rights; the rights come from the state law that applies to you.
Supporting quotations
If you are a resident of California, Colorado, Connecticut, Delaware (as of January 1, 2025), Iowa (as of January 1, 2025), Maryland (as of October 1, 2025), Minnesota (as of July 31, 2025), Montana, Nebraska (as of January 1, 2025), New Hampshire (as of January 1, 2025), New Jersey (as of January 15, 2025), Oregon, Tennessee (as of July 1, 2025), Texas, Utah, and Virginia, the law in your state may provide you with the following rights:
Qualifications & exceptions
Rights are described as ones state law "may" provide; some states are listed with start dates.
Account & Service Control · User right or choice
State rights: information, access, deletion, correction and appeal
The notice lists these state-law rights: information (the policy describes the Personal Data collected and sources in its "Personal Data We Collect" and "How We Collect Personal Data" sections, and the purposes for use and sharing in its "How We Use" and "How We Share" sections); access (request a copy of the Personal Data WHOOP maintains about you); deletion (ask to delete Personal Data WHOOP collected from you); correction (ask to correct inaccuracies); and appeal ("You may be permitted to appeal our decision, if we deny your request"). The rights are what state law may provide, so the notice does not itself set out how to make each request in this part.
Supporting quotations
The Privacy Policy describes the types of Personal Data
Access: You can request a copy of the Personal Data that we maintain about you.
Deletion: You can ask to delete the Personal Data that we have collected from you.
Correction:You can ask to correct inaccuracies in your Personal Data.
Appeal:You may be permitted to appeal our decision, if we deny your request.
Qualifications & exceptions
Appeal is stated as something you "may be permitted" to do if WHOOP denies a request.
Not stated here
This part does not say how to submit access, deletion or correction requests; the "Your Choices" section gives privacy@whoop.com and the Privacy Center Data Management feature.
Sharing & Disclosure · User right or choice
State right to opt out of sale, sharing, targeted advertising and profiling
The notice lists a right to opt out of the selling or sharing of your Personal Data, the processing of your Personal Data for targeted advertising, and/or profiling in furtherance of decisions that produce legal or similarly significant effects. WHOOP says you exercise it according to the instructions in the "Online tracking opt-outs" section. That section describes opt-outs of "certain" interest-based advertising and tracking, many cookie-based. Elsewhere WHOOP says it did not sell Personal Data in the prior 12 months, only shared it as described, and uses cookies and tracking technologies to analyze traffic and facilitate advertising.
Supporting quotations
Opt-out of sale and sharing of your Personal Data: You can ask to opt out of the selling or sharing of your Personal Data, the processing of your Personal Data for purposes of targeted advertising, and/or profiling in furtherance of decisions that produce legal or similarly significant effects, which you can exercise according to the instructions in the “Online tracking opt-outs” section of the Privacy Policy.
WHOOP has not sold any Personal Data. We do not sell Personal Data.
we use Cookies and other tracking technologies to analyze website and application traffic and use, and to facilitate advertising
We and our advertising partners may use Cookies and similar technologies
Qualifications & exceptions
The way to exercise this right is the online tracking opt-outs, which cover "certain" interest-based advertising.
WHOOP states it has not sold Personal Data; the opt-out applies to selling or sharing, targeted advertising and certain profiling.
Not stated here
The text does not describe a separate request form for this right beyond the opt-out instructions.
Sharing & Disclosure · Company practice
California "sold" and "shared" disclosure: no sale; cookies facilitate advertising
For the 12 months before the policy date, WHOOP says it has not sold any Personal Data and does not sell Personal Data, and that it has only shared Personal Data as described in the policy. It says it uses cookies and other tracking technologies to analyze website and application traffic and use, and to facilitate advertising. To limit use of cookies and tracking technologies, it points to its "Online tracking opt-outs" instructions, and says you may also direct WHOOP to share your data as described in the section on how you share Personal Data through the Services.
Supporting quotations
WHOOP has not sold any Personal Data. We do not sell Personal Data.
WHOOP has only shared Personal Data as described above.
we use Cookies and other tracking technologies to analyze website and application traffic and use, and to facilitate advertising
To limit use of Cookies and other tracking technologies, please review the instructions provided in the “Online tracking opt-outs” section.
Qualifications & exceptions
The no-sale statement is given for the 12-month period before the policy date and in the present tense.
The statement that data was "only shared" is tied to sharing "as described above" in the policy.
Not stated here
Whether cookie-based advertising counts as "sharing" under California law is not stated; the text says WHOOP uses cookies to facilitate advertising.
Account & Service Control · Company commitment
No discrimination for exercising privacy rights
WHOOP says you are entitled to exercise the described state privacy rights free from discrimination, and that it will not discriminate against you for exercising your California privacy rights.
Supporting quotations
You are entitled to exercise the rights described above free from discrimination.
We will not discriminate against you for exercising your California privacy rights.
Qualifications & exceptions
The commitment is stated for the described state rights and California privacy rights.
Not stated here
The text does not define what counts as discrimination.
Account & Service Control · Procedure
How to submit access, correction, deletion and opt-out requests
To request access to, correction of or deletion of Personal Data collected through your use of the Services, you can use the "Data Management" feature in the WHOOP Privacy Center or email privacy@whoop.com. To learn how to opt out of interest-based ads and other online tracking, the policy points to its "Online tracking opt-outs" section.
Supporting quotations
To exercise these rights, you can submit requests as follows:
please either (i) use the “Data Management” feature available on the WHOOP Privacy Center privacy.whoop.com; or (ii) email us at privacy@whoop.com.
To learn how to opt-out of interest-based ads and other online tracking, see the “Online tracking opt-outs” section of the Privacy Policy.
Qualifications & exceptions
Requests to opt out of ads are handled through the opt-out instructions, not through the Data Management request.
Account & Service Control · Restriction or exception
Identity verification, authorized agents and a limit on requests to know
Before responding to requests, WHOOP may ask you to confirm information it has on file about you or your interactions with it. If it asks for additional Personal Data to verify your identity, it says it will only use that data to verify your identity or your authority to make the request for another consumer. You can empower an authorized agent to submit requests in the same manner, although WHOOP may require the agent to present signed written permission and may require you to independently verify your identity and confirm you gave the agent permission. WHOOP says it is only required to honor requests to know twice in a 12-month period.
Supporting quotations
To verify your identity prior to responding to your requests, we may ask you to confirm information that we have on file about you or your interactions with us.
Where we ask for additional Personal Data to verify your identity, we will only use it to verify your identity or your authority to make the request on behalf of another consumer.
we may require the agent to present signed written permission to act on your behalf, and you may also be required to independently verify your identity with us
we are only required to honor requests to know twice in a 12-month period
You will be asked to complete a verification form in connection with such access or deletion request in order to ensure that you have the authority to access or delete your account.
Qualifications & exceptions
Extra data collected to verify identity is limited to verifying identity or authority.
WHOOP "may require" signed written permission from an authorized agent and may require you to verify with WHOOP.
Requests to know are limited to twice in a 12-month period.
Sharing & Disclosure · User right or choice
California Shine the Light: once-a-year request about sharing for third-party direct marketing
The California Shine the Light law lets a California resident request, once per calendar year, information about Personal Information shared with third parties for their own direct marketing purposes, including the categories of information and the names and addresses of those businesses. WHOOP says to make the request, or ask other questions about its privacy practices and compliance with California law, you should contact it through the contact form on its website.
Supporting quotations
If you are a California resident, the Shine the Light law permits you to request and obtain from us once per calendar year information about any of your Personal Information shared with third parties for their own direct marketing purposes
To request this information and for any other questions about our privacy practices and compliance with California law, please contact us through the contact form on our website.
Qualifications & exceptions
The right is for California residents and limited to once per calendar year.
Not stated here
The policy does not say what the response will list; it only describes what the law permits you to request.
Use & Processing · User right or choice
California right to limit use and disclosure of sensitive personal information
California residents have the right to limit WHOOP's use and disclosure of their sensitive personal information to uses that are necessary to provide the Services or goods they request, or as otherwise permitted by law. WHOOP says sensitive personal information may include consumer health data, biometric information, precise geolocation and other information defined as sensitive under California law.
Supporting quotations
California Right to Limit Use and Disclosure of Sensitive Personal Information.
If you are a California resident, you have the right to limit our use and disclosure of your sensitive personal information to those uses that are necessary to provide the Services or goods you request, or as otherwise permitted by law.
Sensitive personal information may include consumer health data, biometric information, precise geolocation, and other information defined as sensitive under California law.
Qualifications & exceptions
The limit allows uses necessary to provide requested Services or goods, "or as otherwise permitted by law."
The list of sensitive information is introduced with "may include."
Use & Processing · Company practice
How WHOOP uses sensitive personal information and how to limit personalization
WHOOP says it uses sensitive personal information primarily to provide and improve the Services, including delivering health metrics, insights and features you request. If it uses sensitive personal information for additional purposes, such as certain personalization or promotional features, you may have the right to limit that use. WHOOP says it does not share sensitive personal information with third parties for their own advertising or marketing purposes. You can control how sensitive personal information is used for personalization in Privacy Settings in the WHOOP app; if you choose to limit it, WHOOP says it will stop using it to personalize recommendations, offers or similar features, which may affect certain personalized features.
Supporting quotations
We use sensitive personal information primarily to provide and improve the Services, including delivering health metrics, insights, and features you request.
If we use sensitive personal information for additional purposes, such as certain personalization or promotional features within WHOOP, you may have the right to limit that use.
We do not share your sensitive personal information with third parties for their own advertising or marketing purposes.
You can control how your sensitive personal information is used for personalization by visiting Privacy Settings in the WHOOP app. If you choose to limit this use, we will stop using your sensitive personal information to personalize recommendations, offers, or similar features within WHOOP.
Qualifications & exceptions
"Primarily" means other uses are possible, such as certain personalization or promotional features, which you may be able to limit.
The statement on not sharing for third-party advertising is about sensitive personal information.
Legal Rights & Agreement Rules · Company commitment
Transfers from the EU to the U.S. rely on Standard Contractual Clauses "in the interim"
Under "16A. New Trans-Atlantic Data Privacy Framework," the policy recounts that the 2020 Schrems II judgment found the Privacy Shield no longer adequate, and that in 2022 the U.S. and the European Commission announced an "agreement in principle" on a new framework. In the interim, to let transfers of personal data from the EU to the U.S. proceed in line with European law, WHOOP says it will enter into the Standard Contractual Clauses with its vendors who process personal data, and with its customers upon request.
Supporting quotations
The US and the European Commission announced in 2022 an “agreement in principle” to develop a new Trans-Atlantic Data Privacy Framework
The judgment in the Schrems II case issued by the European Court of Justice in 2020 found that Privacy Shield framework no longer provides adequate safeguards for the transfer of personal data to the United States from the EEA.
In the interim, to ensure that transfers of personal data from the EU to the US can occur in line with European data protection laws, Whoop will enter into the Standard Contractual Clauses with our vendors who process personal data, and with our customers upon request.
Qualifications & exceptions
The commitment is for transfers of personal data from the EU to the U.S., "in the interim."
The Standard Contractual Clauses are entered into with vendors who process personal data and with customers upon request.
Not stated here
The text does not say whether WHOOP participates in any framework that has since replaced the interim measure; it describes a 2022 announcement.
The Standard Contractual Clauses are not supplied here.
Account & Service Control · User right or choice
More European rights: portability, objection, restriction, complaint and copy of transfer clauses
Besides the rights covered earlier, the European notice lists: portability (a copy of your Personal Data in a machine-readable format and, where technically feasible, transmission to another controller); objection (telling WHOOP you object to further use or disclosure for certain purposes, such as direct marketing); restriction of processing (asking WHOOP to restrict further processing); the right to lodge a complaint with the supervisory authority in the relevant European Economic Area member state, the UK or Switzerland where you reside; and obtaining a copy of any Standard Contractual Clauses or other international data transfer agreement WHOOP may use to transfer your personal data outside Europe.
Supporting quotations
You can ask for a copy of your Personal Data in a machine-readable format. You can also request that we transmit the data to another controller where technically feasible.
You can contact us to let us know that you object to the further use or disclosure of your Personal Data for certain purposes, such as for direct marketing purposes.
You can ask us to restrict further processing of your Personal Data.
You have the right to lodge a complaint about our practices with respect to your Personal Data with the supervisory authority in the relevant European Economic Area member state, UK or Switzerland, as applicable, where you reside.
Obtain a copy of any Standard Contractual Clauses or other international data transfer agreement we may use to transfer your personal data outside of Europe.
Qualifications & exceptions
Transmission to another controller is available "where technically feasible."
Objection is described for "certain purposes, such as for direct marketing purposes."
The right to a transfer agreement copy covers agreements WHOOP "may use."
Account & Service Control · Procedure
Submitting European rights requests; WHOOP may decline in some cases
For more information about the European rights, or to submit a request, you can email whoop@gdpr-rep.com or privacy@whoop.com. WHOOP says that in some circumstances it may be allowed to wholly or partially decline your request in accordance with applicable data protection laws, including the GDPR, but it will still respond to notify you of the decision in line with the timescales under those laws. WHOOP may also need additional information, which may include Personal Data, to verify your identity and the nature of your request. For questions about the section or its data practices generally, contact privacy@whoop.com.
Supporting quotations
please email whoop@gdpr-rep.com or privacy@whoop.com
in some circumstances, we may be allowed to wholly or partially decline your request in accordance with applicable data protection laws (including the GDPR), but in those circumstances, we will still respond to notify you of such a decision in accordance with the timescales under such laws
we may also need you to provide us with additional information, which may include Personal Data, if necessary to verify your identity and the nature of your request
If you have any questions about this section or our data practices generally, please contact us at privacy@whoop.com.
Qualifications & exceptions
WHOOP may decline a request wholly or partly "in some circumstances" allowed by data protection law, and will still respond.
Verification may require additional information, which may include Personal Data.
Not stated here
The response timescale is left to applicable law and is not stated here.
The circumstances in which a request may be declined are not listed.
Use & Processing · Company practice
Personal Data is processed in the United States
To provide the Services, WHOOP says it will process Personal Data in the United States, where WHOOP is based. To the extent it transfers a European resident's Personal Data to the United States, it says it will do so in accordance with European data protection laws.
Supporting quotations
To provide the Services, we will process your Personal Data in the United States, where WHOOP is based.
To the extent we transfer your Personal Data to the United States, we will do so in accordance with European data protections laws.
Qualifications & exceptions
The commitment on transfers is that they will follow European data protection laws.
Legal Rights & Agreement Rules · Context
Brazil notice: who it applies to and who the controller is
The Brazil notice applies if you are a Brazilian resident, if your Personal Information was collected in Brazil (for example you were located in Brazil when it was collected), or if the data processing activities are performed in Brazil. WHOOP, Inc. is the controller of Personal Data processed in connection with the Services, at One Kenmore Square, #601, Boston, MA 02215, privacy@whoop.com. The Data Protection Officer entry says "Please see here for information on the DPO," a link whose destination is not part of the saved text.
Supporting quotations
If: (a) you are a Brazilian resident; (b) your Personal Information was collected in Brazil (e.g. you were located in Brazil at the moment that your Personal Information was collected); or (c) the data processing activities are being performed in Brazil, this section is applicable to you.
Whoop, Inc. will be the controller of your Personal Data processed in connection with the Services.
Whoop, Inc., One Kenmore Square, #601 Boston, MA 02215, privacy@whoop.com
Please see here for information on the DPO.
Qualifications & exceptions
The notice applies if any one of the three conditions (residence, collection in Brazil, or processing in Brazil) is met.
Not stated here
The information on the Data Protection Officer is behind a link that is not supplied here.
Legal Rights & Agreement Rules · Company practice
Brazil legal bases for processing
For Brazil, WHOOP says it will only process Personal Data if it has a lawful basis, which can include consent, performance of an agreement and its legitimate interests, depending on the data and context. It lists the bases it typically relies on: service delivery on the necessity to perform its contract or take steps you request (otherwise its legitimate interest in providing what you request); research and development on its legitimate interests; marketing and advertising on your consent where applicable law requires it, otherwise its legitimate interests in promoting its business; and compliance and protection on a legal obligation, vital interests of you or others, or a task carried out in the public interest.
Supporting quotations
We will only process your Personal Data if we have a lawful basis for doing so. Lawful bases for processing include consent, performance of an agreement and our “legitimate interests”
Processing is necessary to perform our contract, or to take steps that you request prior to engaging our Services.
Processing is based on our legitimate interests.
Processing is based on your consent where that consent is required by applicable law.
we may also need to process Personal Data to comply with a legal obligation, if it is necessary to protect the vital interests of you or other data subjects, or if it is necessary for a task carried out in the public interest
Qualifications & exceptions
The bases are those WHOOP "typically" relies on and depend on the type of data and context.
Marketing relies on consent only where the law requires it.
Use & Processing · User right or choice
Brazil: explicit consent for special-category wellness data and withdrawal
To the extent wellness data WHOOP collects is considered consumer health data or another special category of Personal Data, WHOOP says it asks for your explicit consent to process it. You can use account settings and tools to withdraw consent at any time, including by unpairing your WHOOP Strap, stopping use of a feature, removing WHOOP's access to a third-party service, or deleting your data or account. In some cases, such as when you direct WHOOP to share it, processing is based on consent you expressly grant at the time of collection, which you can withdraw at any time in the manner indicated then or listed in the Services.
Supporting quotations
To the extent that wellness data that we collect is considered consumer health data or another special category of Personal Data, we ask for your explicit consent to process this data.
You can use your account settings and tools to withdraw your consent at any time, including by unpairing your WHOOP Strap, stopping use of a feature, removing our access to a Third-Party service, or deleting your data or your account.
Qualifications & exceptions
Explicit consent applies "to the extent" wellness data is consumer health data or another special category.
Account & Service Control · User right or choice
Brazil: other compatible uses and the right to confirmation of processing
In the Brazil notice WHOOP says it may use Personal Data for reasons not described in the policy where permitted by law and compatible with the purpose of collection, and that it will notify you and explain the legal basis for an unrelated purpose. Among Brazilian data subject rights, which are introduced with "including," is the right to obtain confirmation of the existence of processing of your Personal Data.
Supporting quotations
We may use your Personal Data for reasons not described in this Privacy Policy where permitted by law and where the reason is compatible with the purpose for which we collected it.
If we need to use your Personal Data for an unrelated purpose, we will notify you and explain the applicable legal basis.
You have certain rights with respect to your Personal Data, including:
You have the right to obtain confirmation of the existence of the processing activity of your Personal Data.
Qualifications & exceptions
Compatible new uses are allowed "where permitted by law."
The rights list is introduced with "including."
Account & Service Control · User right or choice
Brazil rights: access, correction, anonymization or deletion, and portability
Brazilian residents are told they have the right to access their Personal Data (a simplified or complete statement of the categories processed, the source and the purposes) and to obtain a full copy of the Personal Data processed based on consent or on a contract; to request correction of incomplete, inaccurate or outdated data; in certain cases, where data is unnecessary, excessive or processed in non-compliance with the LGPD, to request its anonymization, blocking or deletion; and, in certain cases as defined by the Brazilian Data Protection Authority (ANPD) and always respecting WHOOP trade or industrial secrets, to portability to another service provider to the extent technically feasible.
Supporting quotations
If WHOOP processes your Personal Data, you will also have the right to access such Personal Data, i.e. to obtain a simplified or complete statement about the categories of Personal Data processed, the source of the data, and the processing purposes.
You also have the right to obtain a full copy of the Personal Data that is processed based on consent or on a contract.
You have the right to request the correction of incomplete, inaccurate, or outdated data about you.
In certain cases, when your Personal Data is unnecessary, excessive or is processed in non-compliance with the LGPD, you have the right to request the anonymization, blocking or deletion of this data.
In certain cases, as defined by the Brazilian Data Protection Authority (ANPD) and in compliance with its regulations, and always respecting WHOOP trade or industrial secrets, you have the right to the portability of your Personal Data to another service provider to the extent technically feasible.
Qualifications & exceptions
The full-copy right is stated for data processed based on consent or on a contract.
Anonymization, blocking or deletion applies "in certain cases" (unnecessary, excessive or non-compliant processing).
Portability applies "in certain cases," as defined by the ANPD, respecting WHOOP trade or industrial secrets, and to the extent technically feasible.
Not stated here
The access item contains an incomplete conditional sentence ("If your Personal Data is processed based on your consent, or on a contract entered into by you with WHOOP."), so its exact reach is not fully clear from the text.
Account & Service Control · User right or choice
Brazil rights: deletion of consent-based data and information on recipients
Where data is processed based on your consent, Brazilian residents have the right to request deletion of that Personal Data, except in cases where WHOOP has the right to retain the data under the LGPD. They also have the right to obtain information about the public and private entities with which WHOOP has shared their Personal Data.
Supporting quotations
In cases where your data is processed based on your consent, you have the right to request the deletion of such Personal Data, except in cases where WHOOP has the right to retain the data under the LGPD.
You have the right to obtain information about the public and private entities with which WHOOP has shared your Personal Data.
Qualifications & exceptions
Deletion is stated for data processed based on consent and is subject to WHOOP's right to retain data under the LGPD.
Not stated here
The cases in which WHOOP may retain data under the LGPD are not listed.
Account & Service Control · User right or choice
Brazil: refusing and revoking consent
When WHOOP asks for consent to process Personal Data, Brazilian residents have the right to refuse it, and WHOOP says it will always inform them about this right and the consequences of not consenting. When they consent for a specific purpose, they may revoke consent at any time. WHOOP adds that in that case all processing carried out up to the date of revocation is ratified, meaning earlier processing is treated as valid.
Supporting quotations
Whenever we ask for your consent to process your Personal Data, you have the right to refuse consent. We will always inform you about this right, and about the consequences if you prefer not to provide consent.
whenever you consent to the processing of your Personal Data for a specific purpose, you may revoke your consent at any time. In that case, all processing activities carried out up to the date of revocation of consent will be ratified.
Qualifications & exceptions
Revoking consent does not undo processing already carried out; it is "ratified" up to the revocation date.
Account & Service Control · User right or choice
Brazil: complaint to the ANPD, objection to unlawful processing and review of automated decisions
Brazilian residents have the right to lodge a complaint against WHOOP with the ANPD about their Personal Data; to object to any processing activity that violates the LGPD; and to request a review of decisions made solely on the basis of automated processing of Personal Data that affect their interests, including decisions intended to define their personal, professional, consumer and credit profile or aspects of their personality.
Supporting quotations
You have the right to lodge a complaint against WHOOP before the ANPD in relation to your Personal Data.
You have the right to object to any processing activity of your Personal Data that violates the provisions of the LGPD.
You have the right to request a review of decisions made solely on the basis of automated processing of Personal Data that affect your interests, including decisions intended to define your personal, professional, consumer and credit profile or aspects of your personality.
Qualifications & exceptions
Objection is limited to processing that violates the LGPD.
Not stated here
How a review of automated decisions is carried out is not described.
Account & Service Control · Procedure
Brazil: how to submit requests and when WHOOP may not fully comply
To learn more about the Brazil rights or submit a request, you can email privacy@whoop.com. WHOOP says that in some circumstances it may not be able to fully comply with a request, such as if it is frivolous or extremely impractical, if it jeopardizes the rights of others, or if it is not required by law, but in those circumstances it will still respond to notify you. It may also need additional information, which may include Personal Data, to verify your identity and the nature of your request.
Supporting quotations
please email privacy@whoop.com
in some circumstances, we may not be able to fully comply with your request, such as if it is frivolous or extremely impractical, if it jeopardizes the rights of others, or if it is not required by law, but in those circumstances, we will still respond to notify you of such a decision
we may also need you to provide us with additional information, which may include Personal Data, if necessary to verify your identity and the nature of your request
Qualifications & exceptions
The reasons for not fully complying are given as examples ("such as").
Verification may need additional information, which may include Personal Data.
Data Access & Collection · Company commitment
Brazil: minors under 18
In the Brazil notice, if you are under 18, WHOOP asks you not to register for the Services or send it Personal Data about yourself. If WHOOP learns it has collected Personal Data from an unauthorized minor, it says it will promptly delete that information from its platform. If you believe an unauthorized minor may have provided Personal Data, you can contact privacy@whoop.com.
Supporting quotations
If you are under the age of 18, please do not attempt to register for the Services or send any Personal Data about yourself to WHOOP.
If we learn that we have collected Personal Data from an unauthorized minor, we will promptly delete that information from our platform.
Qualifications & exceptions
The age stated in this notice is 18; the term used is "unauthorized minor."
Not stated here
"Unauthorized minor" is not defined.
Sharing & Disclosure · Company commitment
Brazil: international transfers use safeguards where protection is not adequate
WHOOP says some third parties with access to Personal Data may be located in other countries or may process data outside Brazil, where the level of data protection may not be equivalent to Brazil's. Where it transfers Personal Data to a country that does not provide an adequate level of protection, it says it will only do so under appropriate safeguards to protect the data.
Supporting quotations
Some of the third parties that have access to your Personal Data may be located in other countries or may process data outside Brazil.
Where we transfer Personal Data to a country that doesn't provide an adequate level of protection, we’ll only do so under appropriate safeguards to protect your Personal Data.
Qualifications & exceptions
The safeguards promise applies where the destination country does not provide an adequate level of protection.
Not stated here
The safeguards are not described in this paragraph.
Legal Rights & Agreement Rules · Context
India notice: additional rights and where the policy describes data and purposes
For residents of India, WHOOP says you may have additional rights under applicable data protection laws. The notice says the Privacy Policy lists the description of Personal Data collected in its "Personal Data We Collect" section, and describes the specified purposes for processing in its "How We Use Personal Data" and "How We Share Personal Data" sections.
Supporting quotations
If you reside in India, you may have additional rights under applicable data protection laws.
The Privacy Policy lists down the description of the Personal Data we collect about you in the “Personal Data We Collect ” section above.
Qualifications & exceptions
The additional rights are stated as ones you "may have" under applicable law.
Account & Service Control · Procedure
India grievance redressal: Grievance Officer, 60-day acknowledgment, Data Protection Board
For India, questions, concerns, complaints or grievances about the privacy policies, processing of Personal Data or your rights can be sent to the Grievance Officer at privacy@whoop.com or to Whoop, Inc., Attn: Legal Department, One Kenmore Square, #601, Boston, MA 02215. Information on the Grievance Officer is behind a link that is not part of the saved text. WHOOP says it will acknowledge your communication within 60 days of receipt. If WHOOP does not address your grievances, you may approach the Data Protection Board of India to make a complaint.
Supporting quotations
please write to our Grievance Officer at privacy@whoop.com or at the mailing address below
Whoop, Inc., Attn: Legal Department, One Kenmore Square, #601 Boston, MA 02215
Information regarding the Grievance Officer may be found here.
We will acknowledge your communication within 60 days of receipt.
In the event we do not address your grievances, you may approach the Data Protection Board of India to make a complaint.
Qualifications & exceptions
The commitment is to acknowledge within 60 days of receipt, not to resolve within that time.
Not stated here
The Grievance Officer's identity and details are behind a link that is not supplied here.
No resolution timeline is stated.
Account & Service Control · User right or choice
India access right: summary of data and identities of third parties
Under the India notice's Data Subject Rights, the access right lets you access a summary of your Personal Data being processed by WHOOP along with information on the processing activities undertaken with respect to it. The next item adds, subject to applicable law, the identities of the third parties with whom WHOOP has shared your Personal Data along with a description of that Personal Data.
Supporting quotations
Access: You may access:
A summary of your Personal Data being processed by us along with information on the processing activities undertaken by us with respect to your Personal Data.
Subject to applicable law, the identities of the third parties with whom we have shared your Personal Data along with a description of such Personal Data.
Qualifications & exceptions
Disclosure of third-party identities is "subject to applicable law."
Account & Service Control · User right or choice
India: requesting access, with limits when data was shared for law enforcement
The India access right also covers, subject to applicable law, the identities of the third parties WHOOP has shared your Personal Data with and a description of that data, and any other information WHOOP may be required by law to share. You submit an access request by emailing privacy@whoop.com. WHOOP says it may be restricted in sharing certain information if your Personal Data has been shared with an entity authorized by law, for law enforcement or investigation purposes, under a written order.
Supporting quotations
A summary of your Personal Data being processed by us along with information on the processing activities undertaken by us with respect to your Personal Data.
Subject to applicable law, the identities of the third parties with whom we have shared your Personal Data along with a description of such Personal Data.
Any other information relating to your Personal Data we may be required to share in accordance with applicable law.
You may submit a request to access your Personal Data by emailing us at privacy@whoop.com.
We may be restricted in sharing certain information if your Personal Data has been shared to an entity authorized by law, for law enforcement or investigation purposes, pursuant to a written order.
Qualifications & exceptions
Disclosure of third-party identities is "subject to applicable law."
WHOOP "may be restricted" from sharing certain information where data went to a lawfully authorized entity under a written order.
Account & Service Control · User right or choice
India: correct, complete or update Personal Data
You may correct inaccurate or misleading Personal Data, complete incomplete Personal Data and update Personal Data by contacting privacy@whoop.com.
Supporting quotations
You may correct inaccurate or misleading Personal Data, complete incomplete Personal Data and update Personal Data by contacting privacy@whoop.com.
Account & Service Control · User right or choice
India: withdrawing consent can end processing, may end access to Services, and leads to erasure with exceptions
Where consent is the basis for processing, an India resident may withdraw it by emailing privacy@whoop.com, and WHOOP says it will, within a reasonable time and subject to applicable law, cease to process the Personal Data. WHOOP warns that you may no longer have access to the Services if you withdraw consent. After withdrawal, WHOOP says it will also erase the Personal Data unless it must retain it for compliance with applicable law, but it may retain Aggregated Data or De-identified Data derived from or incorporating your Personal Data that does not identify you.
Supporting quotations
Where consent is the basis for our processing of your Personal Data, when you log into your account you may withdraw such consent by emailing privacy@whoop.com and we will, within a reasonable time and subject to applicable law, cease to process your Personal Data.
However, you may no longer have access to the Services in the event you withdraw your consent to us processing your Personal Data.
we will also, unless we are required to retain your Personal Data for compliance with applicable law, erase your Personal Data, but may retain Aggregated Data or De-identified Data derived from or incorporating your Personal Data that does not identify you
Qualifications & exceptions
Ceasing processing happens "within a reasonable time and subject to applicable law."
Erasure does not apply where WHOOP is required to retain the data to comply with applicable law.
WHOOP may keep aggregated or de-identified data derived from your Personal Data.
Not stated here
"Reasonable time" is not defined.
Account & Service Control · User right or choice
India: erasure requests and naming an agent
You may ask WHOOP to erase the Personal Data it holds by emailing privacy@whoop.com. On receipt, WHOOP says it will erase the data unless it is required to retain it for compliance with applicable law, but may retain Aggregated Data or De-identified Data derived from or incorporating your Personal Data that does not identify you. You may also submit a request to name an agent, an individual who will exercise your rights over WHOOP's processing of your Personal Data if you die or become incapacitated.
Supporting quotations
You may submit a request to erase your Personal Data in our possession, by emailing us at privacy@whoop.com.
unless we are required to retain your Personal Data for compliance with applicable law, we will erase your Personal Data, but we may retain Aggregated Data or De-identified Data derived from or incorporating your Personal Data that does not identify you
You may submit a request to name an agent – an individual who shall, in the event of your death or incapacity, exercise your rights with respect to us processing your Personal Data.
Qualifications & exceptions
Erasure is subject to legal retention requirements, and aggregated or de-identified derived data may be kept.
The agent exercises your rights only in the event of your death or incapacity.
Not stated here
The process for naming an agent is not described beyond submitting a request.
Retention & Deletion · Company commitment
India: no transfers outside India where law restricts them; retention
WHOOP says it will not transfer your Personal Data to any country or territory outside India where such transfer is restricted under applicable law. For retention, the India notice says WHOOP keeps Personal Data for as long as reasonably necessary for the purposes described in the policy, or as required by applicable law (for example tax, legal or accounting purposes), whichever is longer; this wording does not mention a business-need period.
Supporting quotations
We will not transfer your Personal Data to any country or territory outside India, where such transfer is restricted as per applicable law.
We retain Personal Data for as long as reasonably necessary for the purposes described in this Privacy Policy, or as required by applicable law (e.g., for tax, legal, accounting, or other purposes), whichever is longer.
Qualifications & exceptions
The transfer commitment is limited to transfers that are restricted under applicable law.
Not stated here
Which countries are restricted is not listed.
No specific retention period is stated.
Legal Rights & Agreement Rules · Restriction or exception
India: duties you undertake by using the Services
By using the Services, WHOOP says you represent, warrant and undertake to ensure that Personal Data you provide directly (such as completing your profile) is complete, accurate, consistent and verifiably authentic; that you do not impersonate another person when providing Personal Data; that you do not register any false or frivolous grievance or complaint with WHOOP or the Data Protection Board; and that you comply with laws in force when exercising your rights over your Personal Data.
Supporting quotations
By using our Services, you represent, warrant, and undertake to ensure:
That the Personal Data you provide directly to us (such as when completing your profile) is complete, accurate, consistent and verifiably authentic;
To not impersonate another person while providing Personal Data;
To not register any false or frivolous grievance or complaint with Whoop or the Data Protection Board;
To comply with laws in force when exercising your rights in relation to your Personal Data.
Qualifications & exceptions
These are stated as representations, warranties and undertakings you give by using the Services.
Not stated here
The consequences of breaching these duties are not stated here.
Data Access & Collection · Company commitment
India: minors under 18
In the India notice, if you are under 18, WHOOP asks you not to register for the Services or send it Personal Data about yourself. If WHOOP learns it has collected Personal Data from an unauthorized minor, it says it will promptly delete that information from its platform. If you believe an unauthorized minor may have provided Personal Data, you can contact privacy@whoop.com.
Supporting quotations
If you are under the age of 18, please do not attempt to register for the Services or send any Personal Data about yourself to WHOOP.
If we learn that we have collected Personal Data from an unauthorized minor, we will promptly delete that information from our platform.
Not stated here
"Unauthorized minor" is not defined.
Data Access & Collection · Company practice
Israel: providing data is voluntary and consent may be implied
For residents of Israel, WHOOP says you are not obligated by law to provide Personal Data, and that any collection of Personal Data is subject to your consent, which may be implied from your interaction with WHOOP or your use of the Services.
Supporting quotations
you are not obligated by law to provide us with your Personal Data, and any collection of Personal Data is subject to your consent that may be implied from your interaction with us or your use of the Services
Qualifications & exceptions
Consent "may be implied" from interaction or use, not necessarily expressly given.
Retention & Deletion · Company practice
Israel: WHOOP Coach history kept while you use the Services and as WHOOP requires
In the Israel notice, WHOOP says that as long as you use the Services, and as WHOOP requires in light of its legitimate business needs and legal requirements, WHOOP may retain the history of your conversations with WHOOP Coach so you keep access to previous conversations.
Supporting quotations
As long as you use our Services and as WHOOP requires in light of its legitimate business needs and legal requirements it is subject to, WHOOP may retain the history of your conversations with WHOOP Coach
Qualifications & exceptions
Retention is linked to your use of the Services and to WHOOP's legitimate business needs and legal requirements.
Not stated here
No retention period is stated.
Use & Processing · User right or choice
Israel: consent for marketing communications; service emails are not marketing
In the Israel notice, WHOOP says it will request your consent to send marketing materials and will give you the ability to opt out of marketing emails and other communications through the Data Management feature in the Privacy Center or by following the unsubscribe instructions in the message. Emails related to the Services you are provided are treated as Service Related Communications, not marketing communications, and are not subject to this section.
Supporting quotations
We will request your consent to send you marketing materials.
We will also give you the ability to opt-out of marketing-related emails and other communications by going to our “Data Management” feature available in the WHOOP Privacy Center privacy.whoop.com, or by following the opt-out or unsubscribe instructions contained in the marketing-related message.
emails related to the Services you are provided with by WHOOP will not be considered as Marketing Communications but as Service Related Communications, and therefore shall not be subject to this section
Qualifications & exceptions
Service Related Communications are outside the marketing opt-out in this section.
Not stated here
Which emails count as Service Related Communications is not specified.
Legal Rights & Agreement Rules · Context
Japan notice: purpose and company representative
The Japan notice is a supplemental privacy notice provided to consumers in Japan under the Act on the Protection of Personal Information (the APPI). It gives the company address as One Kenmore Square, Boston, MA 02215 and says information regarding the representative of the company is available through a link, which is not part of the saved text.
Supporting quotations
We are providing this supplemental privacy notice to consumers in Japan, pursuant to the Act on the Protection of Personal Information (the “APPI”).
Whoop, Inc. is a company registered in One Kenmore Square, Boston, MA 02215. Information regarding the representative of the company is available here.
Not stated here
The representative's identity is behind a link that is not supplied here.
Use & Processing · User right or choice
Japan: explicit consent for special-care wellness data and withdrawal
In the Japan notice, to the extent wellness data WHOOP collects is considered Special Care-Required Personal Information (as defined in what the text calls the "APPT"), WHOOP says it asks for your explicit consent to process it. You can use account settings and tools to withdraw consent at any time, including by unpairing your WHOOP Strap, stopping use of a feature, removing WHOOP's access to a third-party service, or deleting your data or account. In some cases, such as when you direct WHOOP to share data, it processes Personal Data on consent you expressly grant when collected, and you can withdraw that consent at any time in the manner indicated or listed in the Services.
Supporting quotations
To the extent that wellness data that we collect is considered Special Care-Required Personal Information (as defined in the APPT), we ask for your explicit consent to process this data.
You can use your account settings and tools to withdraw your consent at any time, including by unpairing your WHOOP Strap, stopping use of a feature, removing our access to a Third-Party service, or deleting your data or your account.
When we process Personal Data based on your consent, you have the right to withdraw it any time in the manner indicated at the time you give consent or as listed in our Services.
Qualifications & exceptions
Explicit consent applies "to the extent" wellness data is considered Special Care-Required Personal Information.
The text refers to the "APPT," while the notice elsewhere names the APPI; the saved text says APPT.
Sharing & Disclosure · Company commitment
Japan: transfers outside Japan, with the United States listed
In the Japan notice, WHOOP says your Personal Data may be transferred to third parties located outside Japan, and that it has ensured the recipient has measures equivalent to those required of a Business Handling Personal Information under the APPI. The notice lists the United States as the country where such third parties (other than those in the European Economic Area) are located, "subject to change due to addition and removal of the Third Parties." It points to reports on U.S., Illinois, California and New York personal information protection legislation published in Japanese by Japan's Personal Information Protection Commission. For the measures third parties take, WHOOP says it will examine the suitability of each third party in advance and confirm appropriate security and other measures consistent with the OECD privacy principles it lists.
Supporting quotations
Your Personal Data may be transferred to third parties who may be located outside of Japan. In this regard, we have ensured that the recipient of Personal Data has put in place adequate measures equivalent to those required for a Business Handling Personal Information under the APPI.
Countries where such Third Parties are located (subject to change due to addition and removal of the Third Parties)
WHOOP will thoroughly examine the suitability of each Third Party to which personal information is provided in advance, and confirm that appropriate measures have been taken in terms of security and other factors regarding the handling of personal information
Qualifications & exceptions
The list of countries is subject to change as third parties are added or removed.
Third parties in the European Economic Area are excluded from the listed information.
The measures commitment is to examine suitability and confirm appropriate measures before providing personal information.
Not stated here
The linked reports from Japan's Personal Information Protection Commission are not supplied here, so this card cannot say what they state about U.S. or state laws.
The third parties are not named in this notice.
Account & Service Control · Procedure
Japan: how to exercise rights and verify identity
To exercise your rights in Japan, including access, rectification, erasure, a request for suspension of use, and a request for disclosure of records of third-party transfers, you can email privacy@whoop.com. To verify your identity before responding, WHOOP may ask you to confirm information it has on file about you or your interactions with it. If it asks for additional Personal Data to verify identity, it says it will only use it to verify your identity or your authority to make a request on behalf of another consumer.
Supporting quotations
To exercise your rights including the right to access, the right to rectification, the right to erasure, the right to request for suspension of use, the right to request for disclosure of records of third party transfers, you can email us at privacy@whoop.com.
Where we ask for additional Personal Data to verify your identity, we will only use it to verify your identity or your authority to make the request on behalf of another consumer.
Qualifications & exceptions
Additional data collected for verification is used only to verify identity or authority.
Data Access & Collection · Company commitment
Mexico: controller and express written consent for sensitive wellness data
In the Mexico notice, WHOOP, Inc. is the controller of Personal Data processed in connection with the Services. For residents of Mexico, WHOOP says it will obtain express written consent to collect and process wellness data, which it says is considered "sensitive personal data," including physiological metrics, workout and sleep metadata, activity type and duration, strain and recovery data, physiological profile, and details you choose to submit about diet, medications and female health tracking. It adds that it may use certain of this information to customize your experience as part of the Services.
Supporting quotations
Whoop, Inc. located at One Kenmore Square, #601 Boston, MA 02215, privacy@whoop.com will be the controller of your Personal Data processed in connection with the Services.
If you are a resident of Mexico, WHOOP will obtain your express written consent to collect and process wellness data, which is considered "sensitive personal data"
We may use certain of this information to customize your experience with us as part of our Services.
Qualifications & exceptions
The express written consent commitment is for residents of Mexico and for wellness data described as "sensitive personal data."
Sharing & Disclosure · User right or choice
Mexico: marketing and advertising-partner sharing are with your consent
In the Mexico notice, WHOOP says that with your consent it may use data from your Personal Data and certain data collected when you browse its website to send direct offers or marketing messages or to advertise its Services and products. It says marketing is a secondary purpose not necessary for the legal relationship and that you always have the choice not to receive marketing information, and gives the Data Management and unsubscribe options; you cannot opt out of certain non-marketing emails about the Services. With your consent, it may also share your Personal Data with advertising partners that may collect information on its website through cookies and other automated technologies, including for interest-based advertising.
Supporting quotations
With your consent, we may use data from the Personal Data we collect and certain data collected when you browse our website, to send you direct offers, marketing messages, or advertise the Services or other WHOOP product offerings.
you always have the choice not to receive marketing information
You cannot opt-out of receiving certain non-marketing emails regarding the Services.
With your consent, we may share your Personal Data with advertising partners that may collect information on our website through Cookies and other automated technologies, including for the interest-based advertising purposes described above.
Qualifications & exceptions
Marketing use and advertising-partner sharing in the Mexico notice are stated as "with your consent."
Certain non-marketing emails cannot be opted out of.
Legal Rights & Agreement Rules · Company practice
Qatar: legal obligation as a ground and more than one ground may apply
In the Qatar notice, besides consent and legitimate interests, WHOOP lists a legal obligation ground: when it needs to comply with a legal or regulatory obligation. It says it may process your Personal Data on more than one ground depending on the reason for using it, and that you can contact privacy@whoop.com for details about the specific grounds relied on for your data. The legitimate interests ground, with the balancing tests WHOOP says it carried out, is described immediately before.
Supporting quotations
You can obtain information on any of our balancing tests by contacting us using the details set out later in this notice.
Legal obligation: When we need to comply with a legal or regulatory obligation.
WHOOP may process your Personal Data on more than one ground depending on the reason or grounds for using your Personal Data. Please contact us at privacy@whoop.com if you need details about the specific grounds we are relying on to process your Personal Data.
Qualifications & exceptions
More than one ground may apply to the same data depending on the reason for use.
Data Access & Collection · Company commitment
Qatar: sensitive Personal Data needs explicit consent and the authority's permission
For Qatar, sensitive Personal Data is said to include data relating to ethnic origin, children, health, physical or mental condition, religious beliefs, marital relationships and felonies. WHOOP says it will only collect sensitive Personal Data where strictly required to provide the Services or where it has another lawful basis. Before collecting or using any sensitive Personal Data, it says it will only use the information with your explicit consent and after having obtained the permission of the supervisory authority named earlier.
Supporting quotations
In Qatar, sensitive Personal Data includes data relating to ethnic origin, children, health, physical or mental condition, religious beliefs, marital relationships, and felonies.
WHOOP will only collect sensitive Personal Data where this is strictly required for the provision of the Services or where it has another lawful basis to do so.
Before collecting or using any sensitive Personal Data, we will only use that information with your explicit consent and after having obtained the permission of the supervisory authority set out above.
Qualifications & exceptions
Collection is limited to where "strictly required" for the Services or where another lawful basis exists.
Use requires both your explicit consent and the supervisory authority's permission.
Not stated here
The text does not say which of the data WHOOP collects, such as wellness data, counts as sensitive Personal Data in Qatar beyond listing health among the categories.
Data Access & Collection · Company commitment
Qatar: WHOOP says it does not collect children's Personal Data
In the Qatar notice, WHOOP says it does not collect Personal Data of children. If you are under 18, it asks you not to register or send Personal Data. If WHOOP learns it has collected Personal Data from an unauthorized minor, it says it will promptly delete that information from its platform, and you can contact privacy@whoop.com if you believe an unauthorized minor provided data.
Supporting quotations
WHOOP does not collect Personal Data of children. If you are under the age of 18, please do not attempt to register for the Services or send any Personal Data about yourself to WHOOP.
If we learn that we have collected Personal Data from an unauthorized minor, we will promptly delete that information from our platform.
Not stated here
"Unauthorized minor" is not defined.
Security & Safeguards · Company commitment
Qatar: security measures WHOOP says it implements
In the Qatar notice, WHOOP says it ensures adequate security measures are implemented to protect Personal Data against loss, destruction, modification, disclosure, and accidental or unauthorized access or use. It says these measures include industry-standard encryption, regular cybersecurity assessments, continuity and disaster recovery testing and robust access controls, and invites you to contact privacy@whoop.com for more information.
Supporting quotations
WHOOP ensures that adequate security measures are implemented to protect your Personal Data against loss, destruction, modification, disclosure, and accidental or unauthorized access to or use of your Personal Data.
These measures include industry-standard encryption, regular cybersecurity assessments, continuity and disaster recovery testing, and robust access controls.
Qualifications & exceptions
This Qatar notice describes specific measures; the general security section separately says no security measures are failsafe.
Sharing & Disclosure · Company commitment
Qatar: data is transferred to the United States with safeguards for transfers outside Qatar
In the Qatar notice, WHOOP says that to provide the Services it will transfer your Personal Data to the United States. It says it will ensure adequate safeguards are implemented if and when it transfers Personal Data outside Qatar, so that an adequate degree of protection is afforded to it, and you can contact privacy@whoop.com for more information on how it transfers and protects data outside Qatar.
Supporting quotations
In order to provide the Services, WHOOP will transfer your Personal Data to the United States.
WHOOP will ensure that adequate safeguards are implemented if and when we need to transfer Personal Data outside of Qatar so that an adequate degree of protection is afforded to it.
Not stated here
The safeguards are not described in this paragraph.
Legal Rights & Agreement Rules · Permission or license
Singapore: who the notice applies to, and consent by interacting or signing up
The Singapore notice applies if you are a Singapore resident, your Personal Data was collected in Singapore, or the relevant data processing is performed in Singapore by WHOOP. It also says that by interacting with WHOOP, submitting information to WHOOP, or signing up for any Services, you agree and consent to WHOOP collecting, using and/or disclosing your Personal Data in the manner outlined in the Privacy Policy. This means consent is treated as given through those actions.
Supporting quotations
If: (a) you are a Singapore resident; (b) your Personal Data was collected in Singapore ; or (c) the relevant data processing activities are being performed in Singapore by WHOOP, this section is applicable to you.
By interacting with us, submitting information to us, or signing up for any Services offered by us, you agree and consent to us collecting, using and/or disclosing your Personal Data in the manner outlined in this Privacy Policy.
Qualifications & exceptions
The notice applies if any one of the three conditions is met.
Consent is stated to arise from interacting, submitting information or signing up for any Services.
Not stated here
The text does not say how this deemed consent interacts with the separate consents described elsewhere in the notice, such as for marketing.
Cross-references
contrast (model-proposed): Singapore: marketing with consent, Do Not Call Registry and opt-out — contrast: The Singapore notice says interacting with WHOOP, submitting information or signing up counts as consent to collection, use and disclosure as outlined in the policy, while its marketing paragraph says marketing use is "with your consent" and gives a separate opt-out. The text does not say whether the first consent covers marketing.
Use & Processing · User right or choice
Singapore: marketing with consent, Do Not Call Registry and opt-out
In the Singapore notice, with your consent WHOOP may use Personal Data and certain data collected when you browse its website to send direct offers or marketing messages or advertise its Services and products. If you have registered your telephone number with the National Do Not Call (DNC) Registry, WHOOP says it will not send such marketing messages by phone calls and text messages, unless you previously gave consent to be contacted for those purposes and have not withdrawn it. You can withdraw consent and opt out of marketing emails and other communications through Data Management in the Privacy Center or the unsubscribe instructions; after opting out you may still receive certain non-marketing emails and text messages about the Services as permitted by applicable laws.
Supporting quotations
With your consent, we may use the Personal Data we collect and certain data collected when you browse our website, to send you direct offers, marketing messages or advertise the Services or other WHOOP product offerings.
If you have registered your telephone number with the National Do Not Call (DNC) Registry, we will not send you such marketing messages via phone calls and text messages, unless you have previously given us consent to contact you for such purposes and such consent has not been withdrawn.
We give you the ability to withdraw your consent and opt-out of marketing-related emails and other communications by going to our “Data Management” feature available in the WHOOP Privacy Center privacy.whoop.com, or by following the opt-out or unsubscribe instructions contained in the marketing-related message.
After opting-out, you may still receive certain non-marketing emails and text messages regarding the Services as permitted under applicable laws and regulations.
Qualifications & exceptions
The DNC commitment does not apply if you previously consented to be contacted and have not withdrawn consent.
Opting out does not stop certain non-marketing emails and texts about the Services.
Account & Service Control · User right or choice
Singapore: access requests, 30-day update and possible fee
In the Singapore notice, you can access certain of your Personal Data by logging in or through Data Management, and can generally request a copy of the Personal Data WHOOP possesses or controls and information about the ways it may have been used or disclosed during the past year. WHOOP says it will respond as soon as reasonably possible, except where applicable laws permit or require it not to. If it cannot respond within 30 days, it will, within that time, inform you in writing of when it will respond. A reasonable fee may be charged, and WHOOP will tell you the estimated fee before processing the request. The rights list is introduced with "including."
Supporting quotations
You have certain rights with respect to your Personal Data, including:
You can generally also make a request for a copy of your Personal Data which is our possession or under our control and information about the ways in which your Personal Data may have been used or disclosed during the past year.
We will respond to your request as soon as reasonably possible, except where applicable laws permit or require us not to do so. Should we not be able to respond to your request within 30 days after receiving your request, we will, within such time, inform you in writing of when we will be able to respond to your request.
A reasonable fee may be charged for an access request. If so, we will inform you of the estimated fee before processing your request.
Qualifications & exceptions
WHOOP may decline to respond where applicable laws permit or require it.
A reasonable fee may be charged, with an estimate given before processing.
The 30-day commitment is to inform you in writing of when WHOOP will respond if it cannot respond within 30 days.
Account & Service Control · User right or choice
Singapore: correction requests and passing corrections to other organisations
In the Singapore notice, you may request correction of an error or omission in Personal Data WHOOP possesses or controls, and some data may be corrected directly by logging in. Except where applicable laws permit or require WHOOP not to, it says it will make the correction as soon as practicable and send the corrected Personal Data to every other organisation to which the data was disclosed by WHOOP within a year before the correction request, unless that organisation does not need the corrected data for any legal or business purpose.
Supporting quotations
You may request for the correction of an error or omission in your Personal Data that is in our possession or under our control.
Save where applicable laws permit or require us not to do so, we will make the correction as soon as practicable and send the corrected Personal Data to every other organisation to which the relevant Personal Data was disclosed by us within a year before the date the correction request was made (unless that other organisation does not need the corrected Personal Data for any legal or business purpose).
Qualifications & exceptions
The corrected data goes to organisations that received the data within a year before the request, unless they do not need it for a legal or business purpose.
WHOOP need not correct where applicable laws permit or require it not to.
Account & Service Control · User right or choice
Singapore: withdrawing consent may end the Services and WHOOP reserves its legal rights
In the Singapore notice, you have the right to withdraw consent to collection, use and/or disclosure at any time, except where WHOOP is permitted to collect, use or disclose Personal Data without consent under applicable laws. WHOOP says it will in general seek to process the request within ten business days, depending on the complexity of the request and its impact on the relationship. If you withdraw, you may have to give express consent case by case for uses or disclosures necessary to use any of the Services. The text adds that if you do not provide consent, WHOOP may not be able to continue providing the Services or fulfil its contractual obligations to you, that refusal may result in termination of agreements or arrangements and you being in breach of your obligations under them, and that WHOOP's legal rights and remedies are expressly reserved.
Supporting quotations
You have the right to withdraw your consent to the collection, use and/or disclosure by us of your Personal Data at any time, save where we are permitted to collect, use and/or disclose your Personal Data without your consent under applicable laws and regulations.
In general, we shall seek to process your request within ten (10) business days of receiving it (depending on the complexity of the request and its impact on our relationship with you).
If you do not provide consent, we may not be able to continue to provide our Services to you or fulfil our contractual obligations to you. Your refusal to grant consent may result in the termination of any agreements or arrangements you have with us and you being in breach of your obligations or undertakings under such agreements or arrangements. In the event of such termination or breach, our legal rights and remedies are expressly reserved.
Qualifications & exceptions
Withdrawal does not apply where applicable laws allow processing without consent.
Processing the request within ten business days is stated as a general aim ("in general, we shall seek to").
Refusing consent may end the Services or agreements, and WHOOP reserves its legal rights and remedies.
Sharing & Disclosure · Company commitment
Singapore: overseas transfers need comparable protection
In the Singapore notice, WHOOP says some third parties with access to Personal Data may be located or process data outside Singapore. Where it transfers Personal Data outside Singapore, it says it will take appropriate steps to ensure the overseas recipient is bound by legally enforceable obligations or specified certifications to provide a standard of protection comparable to the Personal Data Protection Act 2012 of Singapore. Data Protection Officer information is said to be available through a link that is not part of the saved text.
Supporting quotations
Where we transfer Personal Data outside Singapore, we will take appropriate steps to ensure that the overseas recipient is bound by legally enforceable obligations or specified certifications to provide the transferred Personal Data a standard of protection that is comparable to that under the Personal Data Protection Act 2012 of Singapore.
Data Protection Officer information can be found here.
Not stated here
The Data Protection Officer information is behind a link that is not supplied here.
Account & Service Control · User right or choice
South Africa: rights under POPIA and complaint to the Information Regulator
Residents of South Africa may have additional rights under the Protection of Personal Information Act, 2013 (POPIA) or other data protection legislation, "including" access (more information and a copy, and some data by logging in or through Data Management); rectification (correct or supplement incorrect or incomplete data); erasure of some or all Personal Data from WHOOP's systems; withdrawal of consent (with a possible need for case-by-case express consent for uses necessary to use the Services); objection to further use or disclosure for certain purposes, such as direct marketing; restriction of processing; and the right to lodge a complaint with the Information Regulator at popiacomplaints@inforegulator.org.za. Information on the South African representative is behind a link that is not part of the saved text.
Supporting quotations
If you are a resident of South Africa, you may have additional rights under the Protection of Personal Information Act, 2013 (POPIA) or other data protection legislation, including:
You can request more information about the Personal Data we hold about you and request a copy of such Personal Data.
If you believe that any Personal Data we are holding about you is incorrect or incomplete, you can request that we correct or supplement such data.
You can request that we erase some or all of your Personal Data from our systems.
if you exercise this right, you may have to then provide express consent on a case-by-case basis for the use or disclosure of certain of your Personal Data, if such use or disclosure is necessary to enable you to utilize some or all of our Services
You can contact us to let us know that you object to the further use or disclosure of your Personal Data for certain purposes, such as for direct marketing purposes.
You can ask us to restrict further processing of your Personal Data.
You have the right to lodge a complaint about our practices with respect to your Personal Data with the Information Regulator at the following email address: popiacomplaints@inforegulator.org.za.
Information regarding our South African representative is available here.
Qualifications & exceptions
The rights are described as ones you "may have," introduced with "including."
Withdrawing consent may require case-by-case express consent for uses necessary to use some or all of the Services.
Not stated here
The South African representative information is behind a link that is not supplied here.
Use & Processing · User right or choice
South Africa: marketing with consent and opt-out
In the South Africa notice, with your consent WHOOP may use data from your Personal Data and certain data collected when you browse its website to send direct offers or marketing messages or advertise its Services and products. You can withdraw consent and opt out of marketing emails and other communications through Data Management in the Privacy Center or the unsubscribe instructions in the message, but you cannot opt out of certain non-marketing emails regarding the Services.
Supporting quotations
With your consent, we may use data from the Personal Data we collectand certain data collected when you browse our website, to send you direct offers, marketing messages or advertise the Services or other WHOOP product offerings.
We give you the ability to withdraw your consent and opt-out of marketing-related emails and other communications by going to our “Data Management” feature available in the WHOOP Privacy Center privacy.whoop.com, or by following the opt-out or unsubscribe instructions contained in the marketing-related message.
You cannot opt-out of receiving certain non-marketing emails regarding the Services.
Qualifications & exceptions
Certain non-marketing emails regarding the Services cannot be opted out of.
Sharing & Disclosure · Company commitment
South Africa: data is transferred to the United States with safeguards for transfers outside South Africa
In the South Africa notice, WHOOP says that to provide the Services it will transfer your Personal Data to the United States, and that it will ensure adequate safeguards are implemented if and when it transfers Personal Data outside South Africa.
Supporting quotations
In order to provide the Services, WHOOP will transfer your Personal Data to the United States. WHOOP will ensure that adequate safeguards are implemented if and when we need to transfer Personal Data outside of South Africa.
Not stated here
The safeguards are not described.
Legal Rights & Agreement Rules · Context
South Korea notice: Korean law applies
The South Korea notice says that for Korean data subjects, the Personal Information Protection Act (PIPA) of Korea and other laws and regulations on data privacy in Korea apply.
Supporting quotations
For Korean data subjects, the Personal Information Protection Act (“PIPA”) of Korea and other laws and/or regulations regarding data privacy in Korea apply.
Not stated here
The introduction lists a Taiwan notice, but the saved text has no Taiwan notice; the South Korea notice is the last in the saved text.
Legal Rights & Agreement Rules · Company practice
South Korea: legal bases are consent and contract necessity
In the South Korea notice, WHOOP says it processes Personal Data under two legal bases for the purposes stated in the "How We Use Personal Data" section: your consent (citing Article 15(1)(i) of the Korean Personal Information Protection Act), and necessity to perform a contract with the data subject or to take actions at the data subject's request when entering into a contract (Article 15(1)(iv)). For each basis the notice lists the same items of Personal Data: contract details, profile data, communications, wellness data, conversations, payment and transactional data, marketing data, geolocation data and online activity data.
Supporting quotations
We process your Personal Data pursuant to the following legal bases for the purposes stated in
HOW WE USE PERSONAL DATA of this Privacy Policy.
Your consent (PIPA Article 15(1)(i)) Items of Personal Data we collect: Contract details; profile data; communications; wellness data; conversations; payment and transactional data; marketing data; geolocation data, online activity data
Necessary to perform a contract with a data subject or to take actions at the request of the data subject in the process of entering into a contract (PIPA Article 15(1)(iv))
Items of Personal Data we collect: Contract details; profile data; communications; wellness data; conversations; payment and transactional data; marketing data; geolocation data, online activity data
Qualifications & exceptions
The same list of data items is given for both legal bases.
Not stated here
The text of the cited PIPA articles is not supplied here.
The notice does not map particular purposes to particular legal bases.
Sharing & Disclosure · Restriction or exception
South Korea: the transfer provisions override the general sharing section
For Korean data subjects, the notice says its transfer provisions apply "notwithstanding" the policy's numbered section on how WHOOP shares Personal Data, which it numbers 6. It states that WHOOP collects and processes Personal Data in the United States and shares Personal Data with the third parties listed below. A note defines "outsourcing" as transfers of personal data to WHOOP's service providers for WHOOP's benefit and business purpose, consistent with the original purposes for collection and use.
Supporting quotations
Notwithstanding "6. HOW WE SHARE PERSONAL DATA” in this Privacy Policy, the following provisions will apply to Korean data subjects.
We collect and process Personal Data in United States.
We share your Personal Data with third parties below.
Note: Outsourcing refers to personal data transfers to service providers of WHOOP for the benefit and business purpose of WHOOP consistent with the original purposes for the collection/use of personal data.
Qualifications & exceptions
The provisions apply to Korean data subjects and take precedence over the general sharing section where they differ.
"Outsourcing" is defined as transfers to WHOOP's service providers for WHOOP's benefit and business purpose, consistent with the original purposes.
Sharing & Disclosure · User right or choice
South Korea: you may object to cross-border transfer, but then you can no longer use the Services
Korean data subjects have the right to object to the cross-border transfer of their Personal Data by submitting a request to privacy@whoop.com. WHOOP states that in that case the ability to use the Services will cease.
Supporting quotations
You have the right to object to the cross-border transfer of your Personal Data by us as above by submitting a request to privacy@whoop.com, in which case your ability to use the Services will cease.
Qualifications & exceptions
Objecting to the cross-border transfer ends your ability to use the Services.
Sharing & Disclosure · Company practice
South Korea: Transcend receives transferred data
In the South Korea notice, WHOOP lists Transcend among the third parties it transfers Personal Data to. The entry gives the type of transfer as "Outsourcing / Privacy rights data", the purpose as "Data rights management", the countries as "United States, Ireland, and Germany, in times of collection, via network", the retention period as "As long as necessary to fulfill the purposes on the left", and the legal basis as "PIPA Article 28-8(1)(i), PIPA Article 28-8(1)(iii)". A website and a contact for Transcend are also listed. The legal basis cites articles of the Korean Personal Information Protection Act; the text of those articles is not supplied here.
Supporting quotations
Transcend
Website:
Contact:
Type of transfer: Outsourcing / Privacy rights data
Countries: United States, Ireland, and Germany, in times of collection, via network
Purpose: Data rights management
Retention period: As long as necessary to fulfill the purposes on the left
"As long as necessary to fulfill the purposes on the left" is the retention period stated; no fixed period is given.
Not stated here
Transcend's website and contact are listed as links or addresses, and their content is not supplied here, so this card cannot say what they state.
The entry does not say which specific items of Personal Data are sent beyond the data type in the type of transfer.
Sharing & Disclosure · Company practice
South Korea: Typeform receives transferred data
In the South Korea notice, WHOOP lists Typeform among the third parties it transfers Personal Data to. The entry gives the type of transfer as "Outsourcing / Survey data", the purpose as "Survey execution and management", the countries as "United States, in times of collection, via network", the retention period as "As long as necessary to fulfill the purposes on the left", and the legal basis as "PIPA Article 28-8(1)(i), PIPA Article 28-8(1)(iii)". A website and a contact for Typeform are also listed. The legal basis cites articles of the Korean Personal Information Protection Act; the text of those articles is not supplied here.
Supporting quotations
Typeform
Website: https://admin.typeform.com/to/dwk6pt
Contact: https://www.typeform.com/help/contact/
Type of transfer: Outsourcing / Survey data
Countries: United States, in times of collection, via network
Purpose: Survey execution and management
Retention period: As long as necessary to fulfill the purposes on the left
"As long as necessary to fulfill the purposes on the left" is the retention period stated; no fixed period is given.
Not stated here
Typeform's website and contact are listed as links or addresses, and their content is not supplied here, so this card cannot say what they state.
The entry does not say which specific items of Personal Data are sent beyond the data type in the type of transfer.
Sharing & Disclosure · Company practice
South Korea: UserTesting receives transferred data
In the South Korea notice, WHOOP lists UserTesting among the third parties it transfers Personal Data to. The entry gives the type of transfer as "Outsourcing / User testing data", the purpose as "User research", the countries as "United States, in times of collection, via network", the retention period as "As long as necessary to fulfill the purposes on the left", and the legal basis as "PIPA Article 28-8(1)(i)". A website and a contact for UserTesting are also listed. The legal basis cites articles of the Korean Personal Information Protection Act; the text of those articles is not supplied here.
Countries: United States, in times of collection, via network
Purpose: User research
Retention period: As long as necessary to fulfill the purposes on the left
Legal basis: PIPA Article 28-8(1)(i)
Qualifications & exceptions
"As long as necessary to fulfill the purposes on the left" is the retention period stated; no fixed period is given.
Not stated here
UserTesting's website and contact are listed as links or addresses, and their content is not supplied here, so this card cannot say what they state.
The entry does not say which specific items of Personal Data are sent beyond the data type in the type of transfer.
Sharing & Disclosure · Company practice
South Korea: ZenKraft receives transferred data
In the South Korea notice, WHOOP lists ZenKraft among the third parties it transfers Personal Data to. The entry gives the type of transfer as "Outsourcing / Shipping data", the purpose as "Shipping management", the countries as "in times of collection, via network", the retention period as "As long as necessary to fulfill the purposes on the left", and the legal basis as "PIPA Article 28-8(1)(i), PIPA Article 28-8(1)(iii)". A website and a contact for ZenKraft are also listed. The legal basis cites articles of the Korean Personal Information Protection Act; the text of those articles is not supplied here.
Supporting quotations
ZenKraft
Website: https://zenkraft.com/privacy-policy
Contact: support@zenkraft.com
Type of transfer: Outsourcing / Shipping data
Countries: in times of collection, via network
Purpose: Shipping management
Retention period: As long as necessary to fulfill the purposes on the left
"As long as necessary to fulfill the purposes on the left" is the retention period stated; no fixed period is given.
Not stated here
ZenKraft's website and contact are listed as links or addresses, and their content is not supplied here, so this card cannot say what they state.
The entry does not say which specific items of Personal Data are sent beyond the data type in the type of transfer.
The entry does not name a country; it says only "in times of collection, via network."
Sharing & Disclosure · Company practice
South Korea: Segment receives transferred data
In the South Korea notice, WHOOP lists Segment among the third parties it transfers Personal Data to. The entry gives the type of transfer as "Outsourcing / Sensor, app, and other data", the purpose as "Facilitate data collection and analysis", the countries as "United States, in times of collection, via network", the retention period as "As long as necessary to fulfill the purposes on the left", and the legal basis as "PIPA Article 28-8(1)(i), PIPA Article 28-8(1)(iii)". A website and a contact for Segment are also listed. The legal basis cites articles of the Korean Personal Information Protection Act; the text of those articles is not supplied here.
"As long as necessary to fulfill the purposes on the left" is the retention period stated; no fixed period is given.
Not stated here
Segment's website and contact are listed as links or addresses, and their content is not supplied here, so this card cannot say what they state.
The entry does not say which specific items of Personal Data are sent beyond the data type in the type of transfer.
Sharing & Disclosure · Company practice
South Korea: Shopify receives transferred data
In the South Korea notice, WHOOP lists Shopify among the third parties it transfers Personal Data to. The entry gives the type of transfer as "Outsourcing / Transaction data", the purpose as "E-commerce", the countries as "United States, in times of collection, via network", the retention period as "As long as necessary to fulfill the purposes on the left", and the legal basis as "PIPA Article 28-8(1)(i), PIPA Article 28-8(1)(iii)". A website and a contact for Shopify are also listed. The legal basis cites articles of the Korean Personal Information Protection Act; the text of those articles is not supplied here.
Supporting quotations
Shopify
Website: https://www.shopify.com/legal/privacy
Contact: privacy@shopify.com
Type of transfer: Outsourcing / Transaction data
Countries: United States, in times of collection, via network
Purpose: E-commerce
Retention period: As long as necessary to fulfill the purposes on the left
"As long as necessary to fulfill the purposes on the left" is the retention period stated; no fixed period is given.
Not stated here
Shopify's website and contact are listed as links or addresses, and their content is not supplied here, so this card cannot say what they state.
The entry does not say which specific items of Personal Data are sent beyond the data type in the type of transfer.
Sharing & Disclosure · Company practice
South Korea: Signifyd receives transferred data
In the South Korea notice, WHOOP lists Signifyd among the third parties it transfers Personal Data to. The entry gives the type of transfer as "Outsourcing / Transaction data", the purpose as "Facilitate e-commerce transactions", the countries as "United States, in times of collection, via network", the retention period as "As long as necessary to fulfill the purposes on the left", and the legal basis as "PIPA Article 28-8(1)(i), PIPA Article 28-8(1)(iii)". A website and a contact for Signifyd are also listed. The legal basis cites articles of the Korean Personal Information Protection Act; the text of those articles is not supplied here.
Supporting quotations
Signifyd
Website: https://www.signifyd.com/privacy/
Contact: privacy@signifyd.com
Type of transfer: Outsourcing / Transaction data
Countries: United States, in times of collection, via network
Purpose: Facilitate e-commerce transactions
Retention period: As long as necessary to fulfill the purposes on the left
"As long as necessary to fulfill the purposes on the left" is the retention period stated; no fixed period is given.
Not stated here
Signifyd's website and contact are listed as links or addresses, and their content is not supplied here, so this card cannot say what they state.
The entry does not say which specific items of Personal Data are sent beyond the data type in the type of transfer.
Sharing & Disclosure · Company practice
South Korea: Slack receives transferred data
In the South Korea notice, WHOOP lists Slack among the third parties it transfers Personal Data to. The entry gives the type of transfer as "Outsourcing / User data and other data", the purpose as "Internal WHOOP communications", and the countries as "United States, in times of collection, via network". A website and a contact for Slack are also listed. The legal basis cites articles of the Korean Personal Information Protection Act; the text of those articles is not supplied here.
Type of transfer: Outsourcing / User data and other data
Countries: United States, in times of collection, via network
Purpose: Internal WHOOP communications
Retention period: As long as necessary to fulfill the purposes on the left
Not stated here
Slack's website and contact are listed as links or addresses, and their content is not supplied here, so this card cannot say what they state.
The entry does not say which specific items of Personal Data are sent beyond the data type in the type of transfer.
Sharing & Disclosure · Company practice
South Korea: Slack retention period and legal basis
The Slack entry in the South Korea notice continues with its retention period, "As long as necessary to fulfill the purposes on the left", and its legal basis, "PIPA Article 28-8(1)(i), PIPA Article 28-8(1)(iii)". The purpose listed earlier in the entry is "Internal WHOOP communications." The legal basis cites articles of the Korean Personal Information Protection Act; the text of those articles is not supplied here.
Supporting quotations
Purpose: Internal WHOOP communications
Retention period: As long as necessary to fulfill the purposes on the left
No fixed retention period is given; it is "as long as necessary to fulfill the purposes on the left."
Not stated here
The text of the cited PIPA articles is not supplied here.
Sharing & Disclosure · Company practice
South Korea: Snowflake receives transferred data
In the South Korea notice, WHOOP lists Snowflake among the third parties it transfers Personal Data to. The entry gives the type of transfer as "Outsourcing / Sensor, app, and other data", the purpose as "Data warehousing", the countries as "United States, in times of collection, via network", the retention period as "As long as necessary to fulfill the purposes on the left", and the legal basis as "PIPA Article 28-8(1)(i), PIPA Article 28-8(1)(iii)". A website and a contact for Snowflake are also listed. The legal basis cites articles of the Korean Personal Information Protection Act; the text of those articles is not supplied here.
"As long as necessary to fulfill the purposes on the left" is the retention period stated; no fixed period is given.
Not stated here
Snowflake's website and contact are listed as links or addresses, and their content is not supplied here, so this card cannot say what they state.
The entry does not say which specific items of Personal Data are sent beyond the data type in the type of transfer.
Sharing & Disclosure · Company practice
South Korea: Sprout Social receives transferred data
In the South Korea notice, WHOOP lists Sprout Social among the third parties it transfers Personal Data to. The entry gives the type of transfer as "Outsourcing / Interaction data", the purpose as "Social media management", the countries as "United States, in times of collection, via network", the retention period as "As long as necessary to fulfill the purposes on the left", and the legal basis as "PIPA Article 28-8(1)(i)". A website and a contact for Sprout Social are also listed. The legal basis cites articles of the Korean Personal Information Protection Act; the text of those articles is not supplied here.
Supporting quotations
Sprout Social
Website: https://sproutsocial.com/privacy-policy/
Contact: privacy@sproutsocial.com
Type of transfer: Outsourcing / Interaction data
Countries: United States, in times of collection, via network
Purpose: Social media management
Retention period: As long as necessary to fulfill the purposes on the left
Legal basis: PIPA Article 28-8(1)(i)
Qualifications & exceptions
"As long as necessary to fulfill the purposes on the left" is the retention period stated; no fixed period is given.
Not stated here
Sprout Social's website and contact are listed as links or addresses, and their content is not supplied here, so this card cannot say what they state.
The entry does not say which specific items of Personal Data are sent beyond the data type in the type of transfer.
Sharing & Disclosure · Company practice
South Korea: Stream.io receives transferred data
In the South Korea notice, WHOOP lists Stream.io among the third parties it transfers Personal Data to. The entry gives the type of transfer as "Outsourcing / Interaction data", the purpose as "Management of community and social interactions", the countries as "United States, in times of collection, via network", the retention period as "As long as necessary to fulfill the purposes on the left", and the legal basis as "PIPA Article 28-8(1)(i)". A website and a contact for Stream.io are also listed. The legal basis cites articles of the Korean Personal Information Protection Act; the text of those articles is not supplied here.
Supporting quotations
Stream.io
Website: https://getstream.io/legal/privacy/
Contact: privacy@getstream.io
Type of transfer: Outsourcing / Interaction data
Countries: United States, in times of collection, via network
Purpose: Management of community and social interactions
Retention period: As long as necessary to fulfill the purposes on the left
Legal basis: PIPA Article 28-8(1)(i)
Qualifications & exceptions
"As long as necessary to fulfill the purposes on the left" is the retention period stated; no fixed period is given.
Not stated here
Stream.io's website and contact are listed as links or addresses, and their content is not supplied here, so this card cannot say what they state.
The entry does not say which specific items of Personal Data are sent beyond the data type in the type of transfer.
Sharing & Disclosure · Company practice
South Korea: Stripe receives transferred data
In the South Korea notice, WHOOP lists Stripe among the third parties it transfers Personal Data to. The entry gives the type of transfer as "Outsourcing / Transaction data", the purpose as "Payment processing", the countries as "United States, in times of collection, via network", the retention period as "As long as necessary to fulfill the purposes on the left", and the legal basis as "PIPA Article 28-8(1)(i), PIPA Article 28-8(1)(iii)". A website and a contact for Stripe are also listed. The legal basis cites articles of the Korean Personal Information Protection Act; the text of those articles is not supplied here.
Supporting quotations
Stripe
Website: https://stripe.com/privacy
Contact: dpo@stripe.com
Type of transfer: Outsourcing / Transaction data
Countries: United States, in times of collection, via network
Purpose: Payment processing
Retention period: As long as necessary to fulfill the purposes on the left
"As long as necessary to fulfill the purposes on the left" is the retention period stated; no fixed period is given.
Not stated here
Stripe's website and contact are listed as links or addresses, and their content is not supplied here, so this card cannot say what they state.
The entry does not say which specific items of Personal Data are sent beyond the data type in the type of transfer.
Sharing & Disclosure · Company practice
South Korea: Aircall receives transferred data
In the South Korea notice, WHOOP lists Aircall among the third parties it transfers Personal Data to. The entry gives the type of transfer as "Outsourcing / Call data", the purpose as "Manage WHOOP support line data", the countries as "United States, in times of collection, via network", the retention period as "As long as necessary to fulfill the purposes on the left", and the legal basis as "PIPA Article 28-8(1)(i), PIPA Article 28-8(1)(iii)". A website and a contact for Aircall are also listed. The legal basis cites articles of the Korean Personal Information Protection Act; the text of those articles is not supplied here.
Supporting quotations
Aircall
Website: https://aircall.io/privacy/
Contact: privacy@aircall.io
Type of transfer: Outsourcing / Call data
Countries: United States, in times of collection, via network
Purpose: Manage WHOOP support line data
Retention period: As long as necessary to fulfill the purposes on the left
"As long as necessary to fulfill the purposes on the left" is the retention period stated; no fixed period is given.
Not stated here
Aircall's website and contact are listed as links or addresses, and their content is not supplied here, so this card cannot say what they state.
The entry does not say which specific items of Personal Data are sent beyond the data type in the type of transfer.
Sharing & Disclosure · Company practice
South Korea: Amazon (AWS) receives transferred data
In the South Korea notice, WHOOP lists Amazon (AWS) among the third parties it transfers Personal Data to. The entry gives the type of transfer as "Outsourcing / Sensor, app data, and other data", the purpose as "Cloud storage and data processing", the countries as "United States, in times of collection, via network", the retention period as "As long as necessary to fulfill the purposes on the left", and the legal basis as "PIPA Article 28-8(1)(i), PIPA Article 28-8(1)(iii)". A website and a contact for Amazon (AWS) are also listed. The legal basis cites articles of the Korean Personal Information Protection Act; the text of those articles is not supplied here.
"As long as necessary to fulfill the purposes on the left" is the retention period stated; no fixed period is given.
Not stated here
Amazon (AWS)'s website and contact are listed as links or addresses, and their content is not supplied here, so this card cannot say what they state.
The entry does not say which specific items of Personal Data are sent beyond the data type in the type of transfer.
Sharing & Disclosure · Company practice
South Korea: Amplitude receives transferred data
In the South Korea notice, WHOOP lists Amplitude among the third parties it transfers Personal Data to. The entry gives the type of transfer as "Outsourcing / User interaction data", the purpose as "Analysis of user interactions with webpages and app", the countries as "United States, in times of collection, via network", the retention period as "As long as necessary to fulfill the purposes on the left", and the legal basis as "PIPA Article 28-8(1)(i), PIPA Article 28-8(1)(iii)". A website and a contact for Amplitude are also listed. The legal basis cites articles of the Korean Personal Information Protection Act; the text of those articles is not supplied here.
Supporting quotations
Amplitude
Website: https://amplitude.com/privacy
Contact: privacy@amplitude.com
Type of transfer: Outsourcing / User interaction data
Countries: United States, in times of collection, via network
Purpose: Analysis of user interactions with webpages and app
Retention period: As long as necessary to fulfill the purposes on the left
"As long as necessary to fulfill the purposes on the left" is the retention period stated; no fixed period is given.
Not stated here
Amplitude's website and contact are listed as links or addresses, and their content is not supplied here, so this card cannot say what they state.
The entry does not say which specific items of Personal Data are sent beyond the data type in the type of transfer.
Sharing & Disclosure · Company practice
South Korea: Attentive receives transferred data
In the South Korea notice, WHOOP lists Attentive among the third parties it transfers Personal Data to. The entry gives the type of transfer as "Outsourcing / User interaction data", the purpose as "Analysis of user interactions with marketing campaigns", the countries as "United States, in times of collection, via network", the retention period as "As long as necessary to fulfill the purposes on the left", and the legal basis as "PIPA Article 28-8(1)(i)". A website and a contact for Attentive are also listed. The legal basis cites articles of the Korean Personal Information Protection Act; the text of those articles is not supplied here.
Supporting quotations
Attentive
Website: https://www.attentive.com/legal/privacy
Contact: privacy@attentive.com
Type of transfer: Outsourcing / User interaction data
Countries: United States, in times of collection, via network
Purpose: Analysis of user interactions with marketing campaigns
Retention period: As long as necessary to fulfill the purposes on the left
Legal basis: PIPA Article 28-8(1)(i)
Qualifications & exceptions
"As long as necessary to fulfill the purposes on the left" is the retention period stated; no fixed period is given.
Not stated here
Attentive's website and contact are listed as links or addresses, and their content is not supplied here, so this card cannot say what they state.
The entry does not say which specific items of Personal Data are sent beyond the data type in the type of transfer.
Sharing & Disclosure · Company practice
South Korea: Bringg receives transferred data
In the South Korea notice, WHOOP lists Bringg among the third parties it transfers Personal Data to. The entry gives the type of transfer as "Outsourcing / shipping data", the purpose as "Shipping management data", the countries as "United States, in times of collection, via network", the retention period as "As long as necessary to fulfill the purposes on the left", and the legal basis as "PIPA Article 28-8(1)(i), PIPA Article 28-8(1)(iii)". A website and a contact for Bringg are also listed. The legal basis cites articles of the Korean Personal Information Protection Act; the text of those articles is not supplied here.
Supporting quotations
Bringg
Website: https://www.bringg.com/privacy-policy/
Contact: privacy@bringg.com
Type of transfer: Outsourcing / shipping data
Countries: United States, in times of collection, via network
Purpose: Shipping management data
Retention period: As long as necessary to fulfill the purposes on the left
"As long as necessary to fulfill the purposes on the left" is the retention period stated; no fixed period is given.
Not stated here
Bringg's website and contact are listed as links or addresses, and their content is not supplied here, so this card cannot say what they state.
The entry does not say which specific items of Personal Data are sent beyond the data type in the type of transfer.
Sharing & Disclosure · Company practice
South Korea: Dovetail Research receives transferred data
In the South Korea notice, WHOOP lists Dovetail Research among the third parties it transfers Personal Data to. The entry gives the type of transfer as "Outsourcing / Feedback data", the purpose as "Gather and review customer feedback", the countries as "United States, in times of collection, via network", the retention period as "As long as necessary to fulfill the purposes on the left", and the legal basis as "PIPA Article 28-8(1)(i), PIPA Article 28-8(1)(iii)". A website and a contact for Dovetail Research are also listed. The legal basis cites articles of the Korean Personal Information Protection Act; the text of those articles is not supplied here.
"As long as necessary to fulfill the purposes on the left" is the retention period stated; no fixed period is given.
Not stated here
Dovetail Research's website and contact are listed as links or addresses, and their content is not supplied here, so this card cannot say what they state.
The entry does not say which specific items of Personal Data are sent beyond the data type in the type of transfer.
Sharing & Disclosure · Company practice
South Korea: Dremio receives transferred data
In the South Korea notice, WHOOP lists Dremio among the third parties it transfers Personal Data to. The entry gives the type of transfer as "Outsourcing / Sensor, app, and other data", the purpose as "Enable access and organization of WHOOP data", the countries as "United States, in times of collection, via network", and the retention period as "As long as necessary to fulfill the purposes on the left". A website and a contact for Dremio are also listed. The legal basis cites articles of the Korean Personal Information Protection Act; the text of those articles is not supplied here.
"As long as necessary to fulfill the purposes on the left" is the retention period stated; no fixed period is given.
Not stated here
Dremio's website and contact are listed as links or addresses, and their content is not supplied here, so this card cannot say what they state.
The entry does not say which specific items of Personal Data are sent beyond the data type in the type of transfer.
Sharing & Disclosure · Company practice
South Korea: Dremio retention period and legal basis
The Dremio entry in the South Korea notice ends with its retention period, "As long as necessary to fulfill the purposes on the left", and its legal basis, "PIPA Article 28-8(1)(i), PIPA Article 28-8(1)(iii)". The purpose listed earlier in the entry is "Enable access and organization of WHOOP data." The legal basis cites articles of the Korean Personal Information Protection Act; the text of those articles is not supplied here.
Supporting quotations
Retention period: As long as necessary to fulfill the purposes on the left
No fixed retention period is given; it is "as long as necessary to fulfill the purposes on the left."
Not stated here
The text of the cited PIPA articles is not supplied here.
Sharing & Disclosure · Company practice
South Korea: Hex Technologies receives transferred data
In the South Korea notice, WHOOP lists Hex Technologies among the third parties it transfers Personal Data to. The entry gives the type of transfer as "Outsourcing / Sensor, app, and other data", the purpose as "Enable access and use of data by WHOOP", the countries as "United States, in times of collection, via network", the retention period as "As long as necessary to fulfill the purposes on the left", and the legal basis as "PIPA Article 28-8(1)(i), PIPA Article 28-8(1)(iii)". A website and a contact for Hex Technologies are also listed. The legal basis cites articles of the Korean Personal Information Protection Act; the text of those articles is not supplied here.
"As long as necessary to fulfill the purposes on the left" is the retention period stated; no fixed period is given.
Not stated here
Hex Technologies's website and contact are listed as links or addresses, and their content is not supplied here, so this card cannot say what they state.
The entry does not say which specific items of Personal Data are sent beyond the data type in the type of transfer.
Sharing & Disclosure · Company practice
South Korea: Hightouch receives transferred data
In the South Korea notice, WHOOP lists Hightouch among the third parties it transfers Personal Data to. The entry gives the type of transfer as "Outsourcing / Customer Data", the purpose as "Customer Relations Management", the countries as "United States, in times of collection, via network", the retention period as "As long as necessary to fulfill the purposes on the left", and the legal basis as "PIPA Article 28-8(1)(i), PIPA Article 28-8(1)(iii)". A website and a contact for Hightouch are also listed. The legal basis cites articles of the Korean Personal Information Protection Act; the text of those articles is not supplied here.
Supporting quotations
Hightouch
Website: https://hightouch.com/privacy-policy
Contact: hello@hightouch.com
Type of transfer: Outsourcing / Customer Data
Countries: United States, in times of collection, via network
Purpose: Customer Relations Management
Retention period: As long as necessary to fulfill the purposes on the left
"As long as necessary to fulfill the purposes on the left" is the retention period stated; no fixed period is given.
Not stated here
Hightouch's website and contact are listed as links or addresses, and their content is not supplied here, so this card cannot say what they state.
The entry does not say which specific items of Personal Data are sent beyond the data type in the type of transfer.
Sharing & Disclosure · Company practice
South Korea: Intercom receives transferred data
In the South Korea notice, WHOOP lists Intercom among the third parties it transfers Personal Data to. The entry gives the type of transfer as "Outsourcing / Interaction data", the purpose as "Gather and analyze data from user interactions in chat support feature", the countries as "United States, in times of collection, via network", the retention period as "As long as necessary to fulfill the purposes on the left", and the legal basis as "PIPA Article 28-8(1)(i), PIPA Article 28-8(1)(iii)". A website and a contact for Intercom are also listed. The legal basis cites articles of the Korean Personal Information Protection Act; the text of those articles is not supplied here.
Supporting quotations
Intercom
Website: https://www.intercom.com/legal/privacy
Contact: team@intercom.com
Type of transfer: Outsourcing / Interaction data
Countries: United States, in times of collection, via network
Purpose: Gather and analyze data from user interactions in chat support feature
Retention period: As long as necessary to fulfill the purposes on the left
"As long as necessary to fulfill the purposes on the left" is the retention period stated; no fixed period is given.
Not stated here
Intercom's website and contact are listed as links or addresses, and their content is not supplied here, so this card cannot say what they state.
The entry does not say which specific items of Personal Data are sent beyond the data type in the type of transfer.
Sharing & Disclosure · Company practice
South Korea: Iterable receives transferred data
In the South Korea notice, WHOOP lists Iterable among the third parties it transfers Personal Data to. The entry gives the type of transfer as "Outsourcing / Interaction and transaction data", the purpose as "Gather and analyze data from web interactions, app interactions, and other sources", the countries as "United States, in times of collection, via network", the retention period as "As long as necessary to fulfill the purposes on the left", and the legal basis as "PIPA Article 28-8(1)(i), PIPA Article 28-8(1)(iii)". A website and a contact for Iterable are also listed. The legal basis cites articles of the Korean Personal Information Protection Act; the text of those articles is not supplied here.
"As long as necessary to fulfill the purposes on the left" is the retention period stated; no fixed period is given.
Not stated here
Iterable's website and contact are listed as links or addresses, and their content is not supplied here, so this card cannot say what they state.
The entry does not say which specific items of Personal Data are sent beyond the data type in the type of transfer.
Sharing & Disclosure · Company practice
South Korea: Klaviyo receives transferred data
In the South Korea notice, WHOOP lists Klaviyo among the third parties it transfers Personal Data to. The entry gives the type of transfer as "Outsourcing / Interaction and transaction data", the purpose as "Gather and analyze data from WHOOP webpages and ecommerce platform and other sources", the countries as "United States, in times of collection, via network", the retention period as "As long as necessary to fulfill the purposes on the left", and the legal basis as "PIPA Article 28-8(1)(i), PIPA Article 28-8(1)(iii)". A website and a contact for Klaviyo are also listed. The legal basis cites articles of the Korean Personal Information Protection Act; the text of those articles is not supplied here.
"As long as necessary to fulfill the purposes on the left" is the retention period stated; no fixed period is given.
Not stated here
Klaviyo's website and contact are listed as links or addresses, and their content is not supplied here, so this card cannot say what they state.
The entry does not say which specific items of Personal Data are sent beyond the data type in the type of transfer.
Sharing & Disclosure · Company practice
South Korea: Looker receives transferred data
In the South Korea notice, WHOOP lists Looker among the third parties it transfers Personal Data to. The entry gives the type of transfer as "Outsourcing / Sensor, app, and other data", the purpose as "Access, analyze and visualize data", the countries as "United States, in times of collection, via network", the retention period as "As long as necessary to fulfill the purposes on the left", and the legal basis as "PIPA Article 28-8(1)(i), PIPA Article 28-8(1)(iii)". A website and a contact for Looker are also listed. The legal basis cites articles of the Korean Personal Information Protection Act; the text of those articles is not supplied here.
"As long as necessary to fulfill the purposes on the left" is the retention period stated; no fixed period is given.
Not stated here
Looker's website and contact are listed as links or addresses, and their content is not supplied here, so this card cannot say what they state.
The entry does not say which specific items of Personal Data are sent beyond the data type in the type of transfer.
Sharing & Disclosure · Company practice
South Korea: NetSuite receives transferred data
In the South Korea notice, WHOOP lists NetSuite among the third parties it transfers Personal Data to. The entry gives the type of transfer as "Outsourcing / Enterprise and user data", the purpose as "Enterprise Resource Planning", the countries as "United States, in times of collection, via network", the retention period as "As long as necessary to fulfill the purposes on the left", and the legal basis as "PIPA Article 28-8(1)(i), PIPA Article 28-8(1)(iii)". A website and a contact for NetSuite are also listed. The legal basis cites articles of the Korean Personal Information Protection Act; the text of those articles is not supplied here.
Supporting quotations
NetSuite
Website: https://www.oracle.com/legal/privacy/
Contact: privacy_kr_grp@oracle.com
Type of transfer: Outsourcing / Enterprise and user data
Countries: United States, in times of collection, via network
Purpose: Enterprise Resource Planning
Retention period: As long as necessary to fulfill the purposes on the left
"As long as necessary to fulfill the purposes on the left" is the retention period stated; no fixed period is given.
Not stated here
NetSuite's website and contact are listed as links or addresses, and their content is not supplied here, so this card cannot say what they state.
The entry does not say which specific items of Personal Data are sent beyond the data type in the type of transfer.
Sharing & Disclosure · Company practice
South Korea: Salesforce.com receives transferred data
In the South Korea notice, WHOOP lists Salesforce.com among the third parties it transfers Personal Data to. The entry gives the type of transfer as "Outsourcing / Enterprise and user data", the purpose as "Enterprise data management and analysis", the countries as "United States, in times of collection, via network", the retention period as "As long as necessary to fulfill the purpose on the left", and the legal basis as "PIPA Article 28-8(1)(i), PIPA Article 28-8(1)(iii)". A website and a contact for Salesforce.com are also listed. The legal basis cites articles of the Korean Personal Information Protection Act; the text of those articles is not supplied here.
"As long as necessary to fulfill the purposes on the left" is the retention period stated; no fixed period is given.
Not stated here
Salesforce.com's website and contact are listed as links or addresses, and their content is not supplied here, so this card cannot say what they state.
The entry does not say which specific items of Personal Data are sent beyond the data type in the type of transfer.
Retention & Deletion · Restriction or exception
South Korea: retention periods under Korean law are announced but the saved text stops mid-sentence
The South Korea notice ends with a "Periods of Retention of Personal Data" heading and a sentence that begins "Notwithstanding 11. DATA SECURITY AND RETENTION OF PERSONAL DATA of this Privacy Policy, if required to retain Personal Data pursuant to applicable Korean laws, such as those set out below, we will retain Personal Data for at least the retention". The saved text ends there, so the laws "set out below" and the retention periods are not part of the supplied text. The sentence indicates that where Korean law requires longer retention, that requirement applies in place of the general retention section.
Supporting quotations
Periods of Retention of Personal Data
if required to retain Personal Data pursuant to applicable Korean laws, such as those set out below, we will retain Personal Data for at least the retention
Qualifications & exceptions
The retention rule applies if WHOOP is required to retain Personal Data under applicable Korean laws.
Not stated here
The saved text ends mid-sentence, so the Korean laws and the minimum retention periods are not supplied.
The Taiwan notice listed in the introduction is not present in the saved text.
Legal Rights & Agreement Rules · Restriction or exception
European notice: GDPR rights and precedence over conflicting provisions
For residents of Europe, WHOOP says you may have additional rights under the General Data Protection Regulation (GDPR) and other European data protection and e-privacy laws. It adds that, to the extent of any conflict between the provisions in "this Section 16" and any other provision of the Privacy Policy, the former control to the extent of the conflict. The saved text does not store section numbers, so "this Section 16" is read as this European notice from the order of the numbered headings and from the policy's own cross-references (see the reference decision); that reading is an inference.
Supporting quotations
If you are a resident of Europe, you may have additional rights under the General Data Protection Regulation (the “GDPR”) and other European data protection and e-privacy laws.
To the extent of any conflict between the provisions set out in this Section 16, and any other provision in this Privacy Policy, the former shall control to the extent of such conflict.
Qualifications & exceptions
The precedence rule applies "to the extent of such conflict," and only for the provisions of the section it names.
"Europe" covers the EEA, the United Kingdom and Switzerland per the policy's introduction.
Not stated here
The number "Section 16" is not stored in the saved text; the reading of it as the European notice is inferred from heading order and cross-references, and a "16A" subsection appears before the European notice heading.
Legal Rights & Agreement Rules · Context
WHOOP, Inc. is the controller; EU and UK representatives
For European residents, WHOOP, Inc. is the controller of Personal Data processed in connection with the Services, with the contact address given as Whoop, Inc., Attn: Data Protection Officer, One Kenmore Square, #601, Boston, MA 02215, privacy@whoop.com. WHOOP names an EU Representative (Whoop Limited, 70 Sir John Rogerson's Quay, Dublin 2, Ireland) and a UK Representative (DP Data Protection Services UK Ltd., 16 Great Queen Street, Covent Garden, London). You may contact any one of the representatives at whoop@gdpr-rep.com.
Supporting quotations
WHOOP, Inc. will be the controller of your Personal Data processed in connection with the Services.
Whoop Limited, 70 Sir John Rogerson’s Quay Dublin 2 Dublin, D02 R296, Ireland
DP Data Protection Services UK Ltd. Attn: Whoop, Inc. 16 Great Queen Street, Covent Garden, London, WC2B 5AH, United Kingdom
You may contact any one of the above representatives at: whoop@gdpr-rep.com
Legal Rights & Agreement Rules · Company practice
Legal bases for processing European residents' Personal Data
WHOOP says it will only process Personal Data if it has a lawful basis, which can include consent, contractual necessity and legitimate interests (its own or others'), depending on the data and context. The bases it typically relies on are: for service delivery, necessity to perform its contract or take steps you request, otherwise its legitimate interest in providing what you request; for research and development, its legitimate interests; for marketing and advertising, your consent where applicable law requires it, otherwise its legitimate interests in promoting its business; and for compliance and protection, a legal obligation, protection of vital interests of you or others, or a task in the public interest.
Supporting quotations
We will only process your Personal Data if we have a lawful basis for doing so. Lawful bases for processing include consent, contractual necessity and our “legitimate interests” or the legitimate interest of others
Processing is necessary to perform our contract, or to take steps that you request prior to engaging our Services.
These activities constitute our legitimate interests.
Processing is based on your consent where that consent is required by applicable law. Where such consent is not required by applicable law, we process your personal information for these purposes based on our legitimate interests in promoting our business.
we may also need to process Personal Data to comply with a legal obligation, if it is necessary to protect the vital interests of you or other data subjects, or if it is necessary for a task carried out in the public interest
Qualifications & exceptions
The bases are described as those WHOOP "typically" relies on and "will depend on the type of Personal Data and the specific context."
Marketing relies on consent only where consent is required by applicable law.
Use & Processing · User right or choice
Explicit consent for special-category wellness data, and withdrawing consent
To the extent wellness data WHOOP collects is considered consumer health data or another special category of Personal Data subject to the GDPR, WHOOP says it will ask for your explicit consent to process it. You can use account settings and tools to withdraw consent at any time, including by unpairing your WHOOP Strap, stopping use of a feature, removing WHOOP's access to a third-party service, or deleting your data or your account. In some cases, such as when you direct WHOOP to share data, processing is based on consent you expressly give at the time of collection, and you have the right to withdraw it at any time in the manner indicated then or listed in the Services.
Supporting quotations
To the extent that wellness data that we collect is considered consumer health data or another special category of Personal Data subject to the GDPR, we will ask for your explicit consent to process this data.
You can use your account settings and tools to withdraw your consent at any time, including by unpairing your WHOOP Strap, stopping use of a feature, removing our access to a Third-Party service, or deleting your data or your account.
When we process Personal Data based on your consent, you have the right to withdraw it any time in the manner indicated at the time you give consent or in as listed in our Services.
Qualifications & exceptions
Explicit consent applies "to the extent" wellness data is consumer health data or another special category under the GDPR.
Use & Processing · Company practice
Use for other purposes where compatible; notice for unrelated purposes
WHOOP says it may use Personal Data for reasons not described in the policy where permitted by law and where the reason is compatible with the purpose for which it was collected. If WHOOP needs to use Personal Data for an unrelated purpose, it says it will notify you and explain the applicable legal basis.
Supporting quotations
We may use your Personal Data for reasons not described in this Privacy Policy where permitted by law and where the reason is compatible with the purpose for which we collected it.
If we need to use your Personal Data for an unrelated purpose, we will notify you and explain the applicable legal basis.
Qualifications & exceptions
Compatible new uses are allowed "where permitted by law"; unrelated purposes trigger notice and an explanation of the legal basis.
Not stated here
The text does not say how WHOOP decides a purpose is "compatible."
Retention & Deletion · Company practice
How WHOOP decides the retention period for European residents
To determine the appropriate retention period for Personal Data, WHOOP says it considers the amount, nature and sensitivity of the information, the potential risk of harm from unauthorized use or disclosure, the purposes of processing and whether those purposes can be achieved by other means, and the applicable legal requirements. No specific retention period is given.
Supporting quotations
To determine the appropriate retention period for your Personal Data, we consider the amount, nature, and sensitivity of the information, the potential risk of harm from unauthorized use or disclosure of your Personal Data, the purposes for which we process your Personal Data and whether we can achieve those purposes through other means, and the applicable legal requirements.
Not stated here
No specific retention period is stated for any category of Personal Data.
Use & Processing · Company practice
WHOOP states it makes solely automated decisions with legal or similarly significant effects
Under "Solely automated decision-making," WHOOP says it does make decisions based solely on automated processing involving personal data, including profiling, which produce legal effects or similarly significantly affect you, including in connection with the personal data processing activities described in Section 8 (the WHOOP Coach, Membership Services AI and third-party AI technology section). The text does not say what decisions are made or what they affect.
Supporting quotations
We do make decisions based solely on automated processing involving personal data, including profiling, which produce legal effects or similarly significantly affects you, including in connection with the personal data processing activities described under Section 8 above.
Qualifications & exceptions
The statement is made in the European notice and refers to Section 8, the AI section.
Not stated here
Which decisions are made, what legal or similarly significant effects they have, and what safeguards or rights apply are not stated in this paragraph.
Account & Service Control · User right or choice
European data subject rights: access, rectification, erasure and portability
European residents have rights including access (request more information and a copy of the Personal Data WHOOP holds; some can also be accessed by logging in or through Data Management in the Privacy Center), rectification (request correction or supplementation of incorrect or incomplete data, and correct some directly by logging in), erasure (request erasure from WHOOP's systems) and portability (ask for a copy in a machine-readable format and, where technically feasible, ask WHOOP to transmit it to another controller). The list is introduced with "including," so it is not stated to be the complete set of rights.
Supporting quotations
You have certain rights with respect to your Personal Data, including:
You can request more information about the Personal Data we hold about you and request a copy of such Personal Data.
If you believe that any Personal Data we are holding about you is incorrect or incomplete, you can request that we correct or supplement such data.
You can request that we erase your Personal Data from our systems.
You can ask for a copy of your Personal Data in a machine-readable format. You can also request that we transmit the data to another controller where technically feasible.
Qualifications & exceptions
The rights list is introduced with "including."
Transmission to another controller is available "where technically feasible."
Not stated here
The erasure item does not state conditions, exceptions or timing.
Account & Service Control · User right or choice
Withdrawing consent can require case-by-case consent for some uses
If WHOOP is processing Personal Data based on your consent, you have the right to withdraw it at any time. WHOOP notes that if you do, you may then have to provide express consent on a case-by-case basis for the use or disclosure of certain Personal Data, if that use or disclosure is necessary to enable you to use some or all of the Services.
Supporting quotations
If we are processing your Personal Data based on your consent (as indicated at the time of collection of such data), you have the right to withdraw your consent at any time.
if you exercise this right, you may have to then provide express consent on a case-by-case basis for the use or disclosure of certain of your Personal Data, if such use or disclosure is necessary to enable you to utilize some or all of our Services
Qualifications & exceptions
Withdrawal applies where processing is based on consent.
Some features may require case-by-case express consent after withdrawal.
Sharing & Disclosure · Company practice
Mexico: what you may share with other users, social platforms and the public
In the Mexico notice, depending on your use of the Services, you may share Personal Data with other users of the Services, such as through the WHOOP Live or WHOOP Teams features, where users are by default searchable by other users; with third-party social media platforms or linked accounts, devices or features when you choose to connect your account or post content to social media; and with the public, because when you make Personal Data visible to other users, including through WHOOP Live or WHOOP Teams, it may become publicly available and can be collected, viewed and used by anyone.
Supporting quotations
Depending on your use of the Services, you may share Personal Data with:
users are by default searchable by other users
Third-party social media platforms, or linked accounts, devices, or features, when you choose to connect your account on those services with WHOOP or post content to social media, such as through the WHOOP Live feature;
When you make Personal Data visible to other users of the Services, including through the WHOOP Live or WHOOP Teams features, it may become publicly available and can be collected, viewed, and used by anyone;
Qualifications & exceptions
Sharing with other users and social platforms follows your choice to share, connect or post; users are by default searchable.
Data made visible to other users may become publicly available.
Sharing & Disclosure · Company practice
Mexico: managing entities, corporate wellness programs, and national or international transfers
In the Mexico notice, if your use of the Services is on behalf of or managed by a managing entity such as a coach, team or organizing body, your account information and Personal Data may be shared with it subject to your consent, and the text says you consent to that entity allowing the information to be publicly shared, subject to any features that expressly override that control; the entity determines how it is shared. For employer or organizational corporate wellness programs, WHOOP may share your information with that organization subject to your consent and typically shares only Aggregated Data. WHOOP adds that any of the transfers referred to may be national or international.
Supporting quotations
your account information and Personal Data may be shared with the managing entity subject to your consent, and you hereby consent to that managing entity allowing that information to be publicly shared, subject to any features of the Services that expressly override that control. The managing entity will determine how the relevant information and content is shared
we may share your information with that organization subject to your consent. Typically, we will share only Aggregated Data with these organizations.
any of the transfers referred to above may be national or international
Qualifications & exceptions
Sharing with managing entities and wellness programs is "subject to your consent," and wellness programs typically receive only Aggregated Data.
Transfers may be national or international.
Not stated here
"Typically" leaves open when non-aggregated data could be shared with a wellness program organization.
Account & Service Control · User right or choice
Mexico data subject rights: access, rectification, cancellation, opposition, withdrawing consent
Residents of Mexico are told they have the right to request a copy of the Personal Data WHOOP holds; to request correction of inaccuracies and completion of incomplete data (rectification); to request that the data be cancelled; to oppose processing for specific purposes (opposition); and to withdraw consent at any time. WHOOP adds that withdrawing consent does not make any processing carried out before the withdrawal invalid.
Supporting quotations
If you reside in Mexico, you have the following rights.
you can request a copy of the Personal Data we hold about you
you can request that we correct any inaccuracies in the Personal Data we hold about you and complete any Personal Data where it is incomplete
you can request that the Personal Data we hold about you be cancelled
you have a right to oppose the processing of your Personal Data for specific purposes
you are entitled to withdraw your consent to that processing at any time. If you withdraw your consent, this will not mean any processing we carried out prior to your withdrawal is invalid.
Qualifications & exceptions
Withdrawal of consent is not retroactive: earlier processing remains valid.
Account & Service Control · Procedure
Mexico: how to exercise rights and limit use or disclosure
To exercise Mexico rights, email privacy@whoop.com. WHOOP says it will provide: the documents and information that should accompany the application, including documents to evidence your identity or your representative's capacity; the timeframes to receive a response; and the means of reproduction it will use to provide the requested information. To explore options for limiting how WHOOP uses and discloses your Personal Data so it does not process the data for a particular purpose, the notice says to contact WHOOP "as described in the section 14." The section numbers are not stored in the saved text; "the section 14" is read as the Contact Us section from the order of the numbered headings and the policy's own cross-references (see the reference decision), which is an inference.
Supporting quotations
please email us at privacy@whoop.com. We will provide you with the following: (i) documents and information that should accompany the application, including documents to evidence your identity or your representative's capacity; (ii) timeframes to receive a response from us regarding any request; (iii) the means of reproduction we will use to provide you with the requested information.
If you wish to explore the options to limit how we use and disclose your Personal Data so that we do not process your data for a particular purpose, please contact us as described in the section 14.
Qualifications & exceptions
WHOOP says it will provide the documents needed, the response timeframes and the means of reproduction, but those details are not in this paragraph.
Not stated here
The specific response timeframes, required documents and means of reproduction are not stated in this notice.
"The section 14" is a numbered reference whose number is not stored in the saved text; reading it as the Contact Us section is inferred from heading order and cross-references.
Account & Service Control · User right or choice
Qatar data subject rights
Residents of Qatar are told they have rights to protection of privacy of their Personal Data; lawful processing on the basis of consent or a legitimate purpose; withdrawing consent; objecting to processing in certain circumstances (for example where processing is not necessary for or exceeds the purposes of collection, gives rise to discrimination or unfairness, or violates applicable laws); requesting erasure or deletion in certain circumstances; requesting correction, provided the request is supported with appropriate documentation; being notified of processing and its purposes; being notified of any disclosure of inaccurate Personal Data; and accessing and obtaining a copy of their Personal Data, subject to payment of a fee.
Supporting quotations
If you reside in Qatar, you have the following rights:
right to object to processing in certain circumstances, such as where the processing of your Personal Data is not necessary for or exceeds the purposes for which it has been collected, or where it gives rise to discrimination, unfairness, or violates applicable laws;
right to request erasure or deletion of your Personal Data in certain circumstances;
right to request correction of your Personal Data, provided that such a request is supported with appropriate documentation;
right to access your Personal Data and obtain a copy of your Personal Data, subject to payment of a fee.
right to withdraw consent in respect of processing of your Personal Data;
right to protection of privacy of your Personal Data;
right to lawful processing of your Personal Data on the basis of consent or a legitimate purpose;
right to be notified of the processing of your Personal Data and the purposes of such processing;
right to be notified of any disclosure of inaccurate Personal Data; and
Qualifications & exceptions
Objection and erasure apply "in certain circumstances."
A correction request must be supported by appropriate documentation.
A copy of your Personal Data is "subject to payment of a fee."
Not stated here
The amount of the access fee is not stated.
Account & Service Control · User right or choice
Qatar: right to complain to the supervisory authority
If you reside in Qatar, you also have the right to lodge a complaint with a supervisory authority, in addition to other rights in the notice. The authority named is National Cyber Governance and Assurance Affairs, email privacy@ncsa.gov.qa.
Supporting quotations
If you reside in Qatar, you also have the right to lodge a complaint with a supervisory authority, in addition to other rights set out in the Privacy Notice.
National Cyber Governance and Assurance Affairs
Email: privacy@ncsa.gov.qa.
Legal Rights & Agreement Rules · Company practice
Qatar: consent and legitimate interests as grounds for processing
In the Qatar notice, WHOOP says it processes "End User Personal Data" on the grounds of consent and legitimate interests. For sensitive Personal Data, it relies on your explicit consent to the collection and on having obtained appropriate authorization to process it from the supervisory authority. For legitimate interests, it says it has a legitimate business or commercial reason to process your Personal Data and your interests and fundamental rights do not override those interests. WHOOP says it has carried out balancing tests for all data processing based on legitimate interests and that you can obtain information on them by contacting WHOOP using the details set out later in the notice.
Supporting quotations
WHOOP processes End User Personal Data on the following grounds:
Consent: When you have provided your consent. In the case of sensitive Personal Data, when you have provided your explicit consent to our collection of your Personal Data and we have obtained appropriate authorization to process such sensitive Personal Data from the supervisory authority set out above.
Legitimate interests: When WHOOP has a legitimate business or commercial reason to process your Personal Data, and your interests and your fundamental rights do not override those interests. We have carried out balancing tests for all the data processing we carry out on the basis of our legitimate interests. You can obtain information on any of our balancing tests by contacting us using the details set out later in this notice.
Qualifications & exceptions
Sensitive Personal Data requires both your explicit consent and authorization from the supervisory authority.
Legitimate interests apply where your interests and fundamental rights do not override them.
Not stated here
"End User Personal Data" is not defined in this notice.
Use & Processing · Company commitment
Consumer health data: not sold, used for the Services, consent where required
Consumer health data is described as including, but not limited to, biomarkers, lab samples, lab results, clinical notes and other health metrics, with a pointer to the separate Consumer Health Data Privacy Notice. WHOOP says it does not sell consumer health data to third parties and may use it to provide the Services (delivering results, insights, recommendations and related features). Personalization based on health data is said to occur within WHOOP and not be used for third-party advertising. WHOOP will obtain consent where required by applicable law before using consumer health data for marketing or promotional purposes, and you can opt out of that use at any time. Elsewhere, the policy lists wellness data as a separate category and says that only to the extent wellness data is considered consumer health data or another special category does WHOOP ask for explicit consent to process it. A separate paragraph says WHOOP does not share sensitive personal information with third parties for their own advertising or marketing.
Supporting quotations
Consumer health data, including but not limited to biomarkers, lab samples, lab results, clinical notes, other health metrics.
We do not sell your consumer health data to third parties.
Any personalization based on your health data occurs within WHOOP and is not used for third-party advertising.
We will obtain consent where required by applicable law before using consumer health data for marketing or promotional purposes. You can opt out of this use at any time.
To the extent that wellness data that we collect is considered consumer health data or another special category of Personal Data, we ask for your explicit consent to process this data.
We do not share your sensitive personal information with third parties for their own advertising or marketing purposes.
Wellness data, including but not limited to physiological metrics
Qualifications & exceptions
Consent before marketing use is promised only "where required by applicable law."
Consent for wellness data applies "to the extent" it is considered consumer health data or another special category of Personal Data.
The statements on selling and third-party advertising are about consumer health data and sensitive personal information; other Personal Data is addressed in other sections.
Not stated here
The separate Consumer Health Data Privacy Notice is not in this source, so its additional terms are unknown.
Which wellness data counts as consumer health data under each law is not stated.
The Personal Data WHOOP may collect includes the conversations you take part in with the WHOOP Coach. The policy points to a section it calls "Section 8 below" for the description of the WHOOP Coach.
Supporting quotations
Conversations that you participate in with the WHOOP Coach, as described in Section 8 below;
Qualifications & exceptions
The detail of how the WHOOP Coach works is in the referenced section, not in this item.
Not stated here
"Section 8 below" is a numbered reference; the number is resolved by reference decision.
Charges & Financial Obligations · Company practice
Payment data: payment processors collect card details, WHOOP does not see card numbers
WHOOP may collect payment and transactional data needed to complete orders on the website or through the Services, listed as name, email address, payment card information, bank account number and billing information, plus transaction history. In the same item WHOOP says it does not have access to payment card numbers, and that its payment processors collect the financial information needed to process payments under the processor's own services agreement and privacy policy. The item both lists "payment card information" and says WHOOP lacks card numbers; the processors' own terms are not part of this policy.
Supporting quotations
Payment and transactional data needed to complete your orders on the website or through the Services (including name, email address, payment card information, bank account number, billing information) and your transaction history, although WHOOP does not have access to payment card numbers.
Our payment processors will collect the financial information necessary to process your payments in accordance with the payment processor’s respective services agreement and privacy policy;
Qualifications & exceptions
The list names payment card information and a bank account number, while the same item says WHOOP does not have access to payment card numbers.
Financial information collected by payment processors is governed by the processor's agreement and privacy policy.
Not stated here
The processors are not named and their policies are not supplied.
What WHOOP receives instead of card numbers is not stated.
Data Access & Collection · Company practice
Marketing, device and online activity data
WHOOP may also collect marketing data (your marketing communication preferences and your engagement, such as which marketing emails you open and which links you click); device data (operating system type and version, manufacturer and model, browser type, screen resolution, RAM and disk size, CPU usage, device type, IP address, unique identifiers including identifiers used for advertising, language settings, mobile carrier, network information, and general location such as city, state or geographic area); and online activity data (pages or screens viewed, time spent, the previous website visited, navigation paths, activity on a page or screen, access times and duration).
Supporting quotations
Marketing data, such as your preferences for receiving our marketing communications, and details about your engagement with them (e.g., the marketing emails that you open and the links within them that you click);
unique identifiers (including identifiers used for advertising purposes)
general location information such as city, state, or geographic area;
Online activity data, such as pages or screens you view, how long you spent on a page or screen, the website you visited before visiting our website, navigation paths between pages or screens, information about your activity on a page or screen, access times, and duration of access.
Qualifications & exceptions
Device location here is general (city, state or geographic area); precise geolocation is described separately.
Data Access & Collection · Company practice
Geolocation data includes precise GPS and exercise movement
Geolocation data WHOOP may collect is described as GPS (precise geolocation), IP address, and movement on certain exercise types, "if you give permission for WHOOP to do so." The sentence puts the permission condition at the end of the list, so it is not clear from this text whether the permission applies to every item or only to the exercise movement data.
Supporting quotations
Geolocation data, such as GPS (precise geolocation), IP Address, and movement on certain exercise types if you give permission for WHOOP to do so; and
Qualifications & exceptions
Collection is tied to your permission ("if you give permission for WHOOP to do so").
Not stated here
It is not stated whether permission is required for IP address-based location.
Which exercise types are covered is not stated.
Data Access & Collection · Company practice
Cookies and similar technologies: what WHOOP uses them for
WHOOP uses cookies and similar technologies (pixel tags, web beacons, clear GIFs and JavaScript, together called "Cookies") so its servers can recognize your web browser and tell WHOOP how and when you visit and use the Services, and to analyze trends, learn about its user base, and operate and improve the Services. If you live in Europe, WHOOP says it will obtain your opt-in consent before deploying any cookies other than those regarded under European laws as strictly necessary (Essential Cookies). This paragraph does not state the same opt-in rule for people outside Europe. The California paragraph adds that WHOOP uses cookies and other tracking technologies to analyze website and application traffic and use, and to facilitate advertising.
Supporting quotations
WHOOP uses cookies and similar technologies such as pixel tags, web beacons, clear GIFs, and JavaScript (collectively, “Cookies”) to enable our servers to recognize your web browser and tell us how and when you visit and use our Services, as well as to analyze trends, learn about our user base, and operate and improve our Services.
If you live in Europe, we will obtain your (opt-in) consent prior to deploying any cookies other than cookies which are regarded under European laws as being “strictly necessary”
we use Cookies and other tracking technologies to analyze website and application traffic and use, and to facilitate advertising.
Qualifications & exceptions
The opt-in consent promise for non-essential cookies is stated for people who live in Europe; other regions are not addressed in this paragraph.
Cookies are used both to analyze traffic and to facilitate advertising.
Not stated here
How consent is handled outside Europe is not stated in this paragraph.
Data Access & Collection · Company practice
Essential and functionality cookies
Essential Cookies are described as required to provide features or Services you have requested, for example letting you log into secure areas; disabling them may make certain features and Services unavailable. Functionality Cookies record your choices and settings, maintain your preferences over time and recognize you when you return, and help WHOOP personalize content, greet you by name and remember preferences such as your region.
Supporting quotations
Essential Cookies are required for providing you with features or Services that you have requested.
Disabling these Cookies may make certain features and Services unavailable.
Functional Cookies are used to record your choices and settings regarding our Services, maintain your preferences over time, and recognize you when you return to our Services.
Qualifications & exceptions
Disabling Essential Cookies may make features unavailable.
Data Access & Collection · Company practice
Performance/analytical cookies and marketing cookies
Performance/Analytical Cookies let WHOOP understand how users use the Services by collecting information on how often a user engages with a particular feature; WHOOP says it uses these aggregated statistics internally to improve the Services. They also help WHOOP measure the performance of its advertising campaigns. Google's Google Analytics is given as an example, with a link to Google's own explanation. Marketing Cookies collect data about your online activity and identify your interests so that WHOOP and its advertising partners can provide marketing WHOOP believes is relevant to you; the policy refers to its "Interest-based advertisements" section.
Supporting quotations
Performance/Analytical Cookies allow us to understand how users use our Services by collecting information on how often a user engages with a particular feature of the Services.
Performance/Analytical Cookies also help us measure the performance of our advertising campaigns
Google, Inc. (“Google”) uses Cookies in connection with its Google Analytics services.
Marketing Cookies collect data about your online activity and identify your interests so that we and our advertising partners can provide marketing that we believe is relevant to you.
Qualifications & exceptions
Statistics from performance cookies are described as aggregated and used internally to improve the Services.
Marketing Cookies serve WHOOP and its advertising partners.
Not stated here
Google's use of the information is described on a linked Google page that is not supplied here.
Data Access & Collection · User right or choice
Browser settings can block cookies, including interest-based advertising cookies
WHOOP lists several ways to opt out of certain interest-based advertising and other online tracking. One is blocking cookies in your browser: most browsers let you remove or reject cookies, including cookies used for interest-based advertising, by following the browser's settings. WHOOP notes that many browsers accept cookies by default until you change your settings. A related option for mobile devices is to change your device's advertising ID settings. The summary covers "certain" interest-based advertising and tracking, not necessarily all of it.
Supporting quotations
There are a number of ways you can opt out of certain interest-based advertising and other online tracking activities, which we have summarized below.
Most browsers let you remove or reject Cookies, including Cookies used for interest-based advertising.
Many browsers accept Cookies by default until you change your settings.
Your mobile devices may offer settings that enable you to make choices about the collection, use, or transfer of your advertising ID associated with your mobile device for interest-based advertising purposes.
Qualifications & exceptions
The opt-outs are described as ways to opt out of "certain" interest-based advertising and tracking.
Legal Rights & Agreement Rules · Context
What this Privacy Policy covers and who is responsible
The policy covers Personal Data WHOOP collects about WHOOP members and other consumers who interact with WHOOP or use its services: websites, social media pages, mobile apps, the WHOOP Strap or another WHOOP device, WHOOP Advanced Labs, and related features, content or applications. It does not cover companies or people WHOOP does not own, control or manage, and WHOOP says it is not responsible for third parties' policies and practices. WHOOP does say it is responsible for the data protection practices of its data processors, under the data protection laws of the place where you live.
Supporting quotations
This Privacy Policy applies to Personal Data we collect about WHOOP members and other consumers who interact with WHOOP or use our services
This Privacy Policy does not cover the practices of companies or people that we do not own, control or manage.
we are responsible for the data protection practices of our data processors
We do not control mobile applications, websites, or online services offered or operated by third parties, and we are not responsible for their actions.
Qualifications & exceptions
"Services" is defined to include the sites, apps, WHOOP Strap or other devices and Advanced Labs, plus related features and content.
Third-party practices are excluded, but WHOOP states responsibility for its own data processors.
Not stated here
Which specific third parties count as outside WHOOP's ownership or control is not listed here.
Data Access & Collection · Context
Personal Data means anything that identifies you or can be linked to you
"Personal Data" is defined broadly as any information that identifies you or can reasonably be linked to you, or that counts as "personal information" or "personal data" under applicable laws. "WHOOP" in the policy means Whoop, Inc. together with its wholly-owned subsidiaries. The introduction also states a mission and says WHOOP takes privacy seriously; those statements describe intent and are not specific commitments.
Supporting quotations
Last Updated: August 3, 2026
“Personal Data” means any information that identifies you or can be reasonably linked to you, or information which is otherwise considered to be “personal information” or “personal data” under applicable laws.
Whoop, Inc., including its wholly-owned subsidiaries, (collectively “WHOOP,” “us,” “we,” or “our”)
Qualifications & exceptions
The definition follows applicable law, so what counts can vary by place.
Legal Rights & Agreement Rules · Context
Regional notices and a separate Consumer Health Data notice
WHOOP adds supplemental notices for residents of certain U.S. states and for people in Europe (the European Economic Area, the United Kingdom and Switzerland), Brazil, India, Israel, Japan, Mexico, Qatar, Singapore, South Africa, South Korea and Taiwan. Separately, because WHOOP may process health-related data that counts as "Consumer Health Data" under U.S. state laws, it has a supplemental Consumer Health Data Privacy Notice with more detail. That notice is a separate document and is not part of this source.
Supporting quotations
We have provided supplemental notices below for residents of certain U.S. states and individuals located in the European Economic Area, the United Kingdom, and Switzerland
we have created a supplemental Consumer Health Data Privacy Notice
Please refer to the WHOOP Consumer Health Data Privacy Notice for more details.
Qualifications & exceptions
The Consumer Health Data Privacy Notice is a separate document; its terms are not supplied here.
The supplemental notices are separate sections; whether each country notice is present in the saved text is addressed where those sections appear.
Not stated here
The content of the Consumer Health Data Privacy Notice is not in this source.
The introduction lists a notice for Taiwan, but the saved text contains no Taiwan notice.
Data Access & Collection · Company practice
Where WHOOP collects Personal Data from directly and automatically
WHOOP says it collects Personal Data from you when you give it to WHOOP directly (for example completing your profile, answering a questionnaire or contacting customer support), from the WHOOP Strap or another device you wear, from the WHOOP Coach when you interact with it and receive responses (the policy points to Section 8 for details), and through automatic collection such as cookies, local storage objects, web beacons and similar technologies when you use the Services. The cookies section adds that WHOOP may supplement what it collects from you with information from third parties, including third parties that have placed their own cookies on your device.
Supporting quotations
You, when you provide such information directly to us, such as when completing your profile, responding to a questionnaire, or communicating with us directly through customer support;
WHOOP Strap or another device that you wear;
WHOOP Coach when you interact with and receive responses from the WHOOP Coach as described in Section 8 below;
Automatic data collection, such as Cookies, local storage objects, web beacons, and other similar technologies in connection with your use of the Services;
We may also supplement the information we collect from you with information received from third parties, including third parties that have placed their own Cookies on your device(s).
Qualifications & exceptions
The cookies paragraph says WHOOP may supplement information it collects from you with information received from third parties, including those that placed their own cookies.
Not stated here
"Section 8 below" is a numbered reference to the WHOOP Coach description; the list numbers are not stored as native numbering, so the target is recorded by reference decision.
Data Access & Collection · Company practice
Where WHOOP collects Personal Data from other parties
WHOOP also says it collects Personal Data from others: customers and partners such as employers, insurance companies, coaches, teams or other organizations that engage with the Services; marketing and advertising partners (including joint marketing partners and companies that help with promotion), which may give WHOOP data about how you interact with the Services, ads or communications; independently licensed third-party laboratory or healthcare business partners when you choose to take part in WHOOP Advanced Labs; social media and other third-party platforms and linked accounts, devices or features when you interact with WHOOP pages, post content using the Services, sign in through a third-party site or link accounts, devices or features to your WHOOP account; and data providers such as information services and data licensors, when WHOOP supplements your data.
Supporting quotations
Customers and partners, such as employers, insurance companies, coaches, teams, or other organizations that engage with our Services;
Marketing and advertising partners, such as companies that have entered in joint marketing relationships with us or assist us with marketing or promotional services, which may provide us with data related to how you interact with our Services, advertisements, or communications;
Independently licensed third-party laboratory or healthcare business partners, when you choose to participate in WHOOP Advanced Labs;
Social media, other third-party platforms, and linked accounts, devices, or features, if you interact with our pages on social media sites, post content to their sites using the Services, sign into the Services through a third-party site or service, or otherwise link accounts, devices, or features to your WHOOP account; and
Data providers, such as information services and data licensors, when we supplement your data.
Qualifications & exceptions
Laboratory and healthcare partner data is described as arising only when you choose to participate in WHOOP Advanced Labs.
Social and linked-account data arises from your interaction or linking; data-provider data arises when WHOOP supplements your data.
Not stated here
The list does not say what data each employer, insurer, partner or data provider supplies.
Data Access & Collection · Company practice
Account, contact, profile and communication data WHOOP may collect
WHOOP says it may collect contact details (first and last name, email and mailing address, phone number); profile data (a username and password you set to create a WHOOP account, plus any photographs or information you choose to put in your profile); and the communications you exchange with WHOOP when you write by email, web app or mobile app with questions, feedback or reviews. The lead-in says "may collect," so the list describes types WHOOP may collect, not a guarantee that every item is collected from every person.
Supporting quotations
We may collect the following types of Personal Data:
Contact details, such as your first and last name, email and mailing address, and phone number;
Profile data, such as username and password that you may establish to create a WHOOP account, as well as any photographs or information you choose to include in your WHOOP profile;
Communications that we exchange with you, including when you contact us via email, web app, or mobile app with questions, feedback, or reviews;
Qualifications & exceptions
"May collect" describes possible types, not what is collected from each person.
Data Access & Collection · Company practice
Wellness data covers body measurements, activity and details you choose to submit
WHOOP defines "wellness data" as including, but not limited to, physiological metrics (resting heart rate, heart rate variability, respiratory rate, skin temperature, blood oxygen saturation), acceleration, metadata on workouts and sleep, the type and duration of physical activity, data reflecting strain and recovery, and your physiological profile (birthday, gender identity, weight, height, fitness or athlete level), plus details you choose to submit about habits, diet, medications and female health tracking. The list is open-ended ("including but not limited to"). WHOOP says it may use some of this information to customize your experience as part of the Services.
Supporting quotations
Wellness data, including but not limited to physiological metrics such as resting heart rate, heart rate variability, respiratory rate, skin temperature and blood oxygen saturation level
your physiological profile, including birthday, gender identity, weight, height, fitness/athlete level (e.g., professional or recreational); and details you choose to submit about your habits, diet, medications, and female health tracking.
We may use some of this information to customize your experience with us as part of our Services;
Qualifications & exceptions
The list is open-ended: "including but not limited to."
Habits, diet, medications and female health tracking are described as details you choose to submit.
Customization is stated as a use of "some of this information"; other uses are in later sections.
Not stated here
The text does not say which wellness items are used for customization.