Connected Care Notice of Privacy Practices

WHOOP · agreement dated August 5, 2026 · Official agreement

31 cards.

WHOOP, INCWHOOP Physician Services, PC Notice of Privacy Practices

Medical Groups Notice of Privacy Practices

Effective Date: August 5, 2026

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN ACCESS THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

WHO THIS NOTICE APPLIES TO

This Notice of Privacy Practices ("Notice") describes how protected health information ("PHI") about you may be used and disclosed and explains your rights regarding that information.

This Notice is issued by WHOOP Physician Services, P.C., a Massachusetts professional corporation and the primary professional corporation within the affiliated group, on behalf of itself and the following affiliated professional corporations, which together have designated themselves a single Affiliated Covered Entity under 45 C.F.R. § 164.105(b):

together with their physicians, advanced practice providers, clinical personnel, workforce members, and authorized representatives (collectively, the “WHOOP Covered Entity," "we," "us," or "our"). As members of a single Affiliated Covered Entity, these professional corporations hold themselves out to the public as a single covered entity and may use and disclose PHI for the joint health care operations of the Affiliated Covered Entity.

The professional corporations that make up the WHOOP Covered Entity are legally separate entities that share common ownership and control. Under 45 C.F.R. § 164.105(b), they have designated themselves a single Affiliated Covered Entity. This joint Notice applies to all of them, and the members may use and disclose PHI with one another for the joint treatment, payment, and health care operations of the Affiliated Covered Entity.

OUR RELATIONSHIP WITH WHOOP

The WHOOP Covered Entity provides healthcare services using technology, administrative, and support services made available by WHOOP, Inc. and certain affiliated service providers.

WHOOP, Inc. is not a healthcare provider and does not practice medicine. The WHOOP Covered Entity may share PHI with WHOOP, Inc. and service providers acting on behalf of the WHOOP Covered Entity to support healthcare delivery and operations, including technology hosting, patient support, scheduling, payment processing, communications, security, analytics, quality improvement, and other functions permitted by law.

These service providers are required by law and contract to appropriately safeguard your PHI.

YOUR RIGHTS

When it comes to your PHI, you have certain rights.

Get a Copy of Your Medical Record

Under certain circumstances, you have the right to inspect or obtain an electronic or paper copy of your medical record and other health information we maintain about you.

To request access to your medical record, please email privacy@canvasmedical.com. Canvas Medical maintains our electronic medical record system on behalf of the Medical Groups and coordinates these requests with us. You do not need a Canvas account to submit a request.

We will provide a copy or summary of your medical record, usually within 30 days of your request. We may charge a reasonable, cost-based fee as permitted by law.

Request a Correction

If you believe information in your medical record is incorrect or incomplete, you may request that we amend your medical record by emailing privacy@canvasmedical.com.

Canvas Medical coordinates amendment requests with the Medical Groups, which review and decide such requests in accordance with applicable law.

If we approve your request, we will amend or supplement your medical record as appropriate. Medical records generally are not deleted. If we deny your request, we will provide a written explanation within the time required by law.

Request Confidential Communications

You may ask us to communicate with you in a specific way or at a specific location.

We will accommodate reasonable requests.

Request Restrictions

You may ask us not to use or disclose certain PHI for treatment, payment, or healthcare operations.

We are not required to agree to every request. If we do agree, we will comply unless disclosure is necessary to provide emergency treatment or is otherwise required by law.

If you pay for a healthcare item or service in full out-of-pocket, you may request that we not disclose related PHI to your health plan for payment or healthcare operations purposes. We will honor such requests when required by law.

Receive an Accounting of Disclosures

You may request a list of certain disclosures of your PHI made during the six years before your request.

The accounting will not include disclosures made for treatment, payment, healthcare operations, or certain other disclosures permitted by law.

Obtain a Copy of This Notice

You may request a paper copy of this Notice at any time, even if you agreed to receive it electronically.

Designate a Personal Representative

If an individual has legal authority to act on your behalf, such as through a healthcare power of attorney or guardianship, that individual may exercise your rights and make choices regarding your PHI.

File a Complaint

If you believe your privacy rights have been violated, you may file a complaint using the contact information below.

You may also file a complaint with:

U.S. Department of Health and Human Services Office for Civil Rights 200 Independence Avenue, S.W. Washington, D.C. 20201

1-877-696-6775

https://www.hhs.gov/hipaa

We will not retaliate against you for filing a complaint.

YOUR CHOICES

For certain types of information, you may tell us your preferences regarding disclosure.

You may instruct us whether to:

If you cannot communicate your preference, we may share information if we determine it is in your best interests or necessary to prevent a serious threat to health or safety.

Uses Requiring Your Authorization

Except as otherwise permitted by law, we will obtain your written authorization before:

You may revoke an authorization at any time in writing, except to the extent we have already relied upon it.

HOW WE USE AND DISCLOSE YOUR INFORMATION

Treatment

We may use and disclose your PHI to provide, coordinate, and manage your healthcare. This may include reviewing information you share through the WHOOP platform, consulting with other healthcare professionals involved in your care, documenting care in our electronic medical record, coordinating follow-up care, ordering or reviewing laboratory tests, prescribing medications where appropriate, and communicating with you about your treatment.

Example: A clinician may review your sleep, activity, or physiological information together with questionnaire responses and other clinical information to evaluate your health, develop a treatment plan, or monitor your progress.

Payment

We may use and disclose PHI to obtain payment for healthcare services.

Example: We may submit information to a health insurer to receive payment for services provided to you.

Healthcare Operations

We may use and disclose PHI to support the operation, administration, quality, and improvement of our healthcare services.

Examples include:

WHOOP Platform and Connected Data

In connection with healthcare services, we may receive information that you choose to provide through the WHOOP platform or related technologies, including:

We use this information to support diagnosis, treatment, care coordination, clinical decision-making, and ongoing monitoring. To the extent this information becomes part of your medical record, it is protected as PHI under this Notice.

Telehealth Services

The WHOOP Covered Entity may provide healthcare services through telehealth technologies, including video visits, audio communications, secure messaging, electronic questionnaires, remote monitoring tools, and other digital health technologies.

PHI collected or generated during telehealth encounters will be used and disclosed as described in this Notice.

Appointment Reminders and Health-Related Communications

We may contact you regarding appointments, treatment alternatives, follow-up care, care management programs, prescription information, or other health-related services that may be relevant to your care.

OTHER USES AND DISCLOSURES PERMITTED OR REQUIRED BY LAW

Public Health Activities

We may disclose PHI for public health purposes, including:

Health Oversight Activities

We may disclose PHI to government agencies authorized to oversee healthcare systems, providers, and compliance activities.

Research

We may use or disclose PHI for research purposes when permitted by law and subject to applicable privacy protections.

Compliance with Law

We may disclose PHI when required by federal, state, or local law.

Law Enforcement and Legal Proceedings

We may disclose PHI in response to court orders, subpoenas, legal processes, law enforcement requests, or other governmental requests when permitted or required by law.

Workers' Compensation

We may disclose PHI as necessary to comply with workers' compensation laws and similar programs.

Organ Donation

We may disclose PHI to organizations involved in organ, eye, or tissue procurement and transplantation.

Medical Examiners and Funeral Directors

We may disclose PHI to coroners, medical examiners, or funeral directors as authorized by law.

Specialized Government Functions

We may disclose PHI for military, national security, protective services, and other specialized government functions as authorized by law.

SUBSTANCE USE DISORDER RECORDS

To the extent we maintain records that are subject to 42 C.F.R. Part 2, we will comply with applicable federal requirements governing the use and disclosure of substance use disorder treatment records.

We will not use or disclose such records for investigations or proceedings against you except as permitted by applicable law.

ADDITIONAL PROTECTIONS UNDER STATE LAW

Certain state laws may provide additional privacy protections for specific categories of health information, including information relating to mental health treatment, reproductive healthcare, HIV/AIDS, genetic testing, substance use disorder treatment, sexually transmitted infections, and other sensitive health information.

When state law provides greater privacy protections than federal law, we will comply with the more protective requirements.

ELECTRONIC COMMUNICATIONS AND PATIENT ACCESS

We may communicate with you electronically through the WHOOP platform, patient portals, secure messaging systems, email, text message, or other electronic means as permitted by law.

Available technologies may allow you to access portions of your health information, communicate with providers, review treatment information, and manage aspects of your care.

OUR RESPONSIBILITIES

We are required by law to:

We will not use or disclose your PHI in a manner inconsistent with this Notice unless you authorize us to do so or the law permits or requires the use or disclosure.

CHANGES TO THIS NOTICE

We may revise this Notice from time to time.

Any revised Notice will apply to all PHI we maintain and will be made available through applicable websites, patient portals, and upon request.

CONTACT INFORMATION

WHOOP Physician Services, P.C. serves as the primary contact and Privacy Officer for the WHOOP Covered Entity. You may contact the Privacy Officer with any questions about this Notice or your privacy rights using the information below.

Privacy Officer WHOOP Physician Services, P.C.

Email: privacy@whoop.com

Mailing Address:

One Kenmore Square Boston, MA 02215