Privacy Policies — Privacy Principles, Messaging Privacy Policy, CCPA and Consumer Health Data Privacy Notice

WHOOP · agreement dated August 3, 2026 · Official agreement

80 cards.

WHOOP, INCPrivacy

> At WHOOP, our mission is to unlock human performance. We exist to improve your life, not invade it.
> ## Privacy Principles

At WHOOP, our mission is to unlock human performance. We exist to improve your life, not invade it. We believe this should be the standard for all companies providing wearable devices.

We take your privacy seriously and want you to understand how we use, collect and share personal data, and the measures we take to protect your personal data. We have invested heavily, and will continue to invest, in features and security to protect the privacy and security of your personal data. We continually evaluate our privacy practices to align them with applicable privacy laws including the California Consumer Privacy Act (“CCPA”) and the General Data Protection Regulation (“GDPR”). You can find more detailed information about ways in which we use, collect, and share personal data in our full Privacy Policy.

  • WHOOP MEMBERS CONTROL THEIR PERSONAL DATA

We believe you should be in control of your personal data. Consistent with this belief:

We prioritize the accountability and the security of your personal data. Our policy is that a member’s personal data is not to be accessed or shared by anyone at WHOOP without an explicit need to do so. Consistent with these priorities and our policy:

Our business model is to provide highly valuable product experiences and services to our members in exchange for membership fees. As such, we never sell our members’ personal data. This is our promise. Because of how broadly the CCPA defines “sale,” we want to be clear that we use third party cookies and other tracking technologies.

Our members provide us with an unprecedented amount of accurate physiological data that is collected by their WHOOP strap. This information includes heart rate, heart rate variability, sleep duration, respiratory rate, skin temperature, blood oxygen saturation level, data such as the type of activity engaged in and the duration of physical activity, and any additional information members chose to enter when using WHOOP services (collectively, “wellness data”).We use aggregated or de-identified wellness data that no longer identifies a particular individual (and is thus no longer personal data) to help answer important questions about human performance and further explore what it means to be optimal. We believe we have a responsibility to create an ever-better experience for our members by identifying and sharing cutting edge insights. We will always look to provide new content and product features, improve and customize our services (including determining and reporting on trends, sleep, strain, and recovery), and develop thought leadership in the area of human performance. We hope your experience with WHOOP will improve over time as our membership base grows and we continue with our mission to unlock human performance.

  • WHOOP BELIEVES THAT THIRD PARTIES SHOULD BE PREVENTED FROM INVADING OUR MEMBERS’ LIVES BY ACCESSING THEIR WHOOP DATA.

Like all other companies, WHOOP may from time to time receive requests for member data from third parties, like governmental entities (including law enforcement) and private parties engaged in civil litigation. Here are the key principles we stand by when evaluating these requests:

If you are concerned about the privacy of your WHOOP data, you can delete it at any time by exercising our self-serve options, either in the WHOOP app or navigating to the data management section of whoop.com.We know privacy and security are important to you. We are committed to making WHOOP the best tool to monitor and understand the body. We will continue to be transparent about our privacy and security practices as we grow alongside our membership.

For more information about how these principles apply to WHOOP Coach, please read here.

Full Privacy Policy

For more information, please read our full privacy policy.

Learn more

Privacy Inquiries

To request access to or deletion of Personal Data collected via your use of the Services, please either (i) use the “Data Management” feature available on the WHOOP Privacy Center privacy.whoop.com; or (ii) email us at privacy@whoop.com.

Our Privacy Officer (and equivalent roles globally) is Travis Lang, General Counsel, who can be reached at privacy@whoop.com.

Messaging Privacy Policy

This Messaging Program Privacy Policy explains how WHOOP collects and uses information about you in relation to its text message marketing and transactional programs (the “Messaging Service”). We use Iterable to provide the Messaging Service to you. For the purposes of the Messaging Service, Iterable acts as our service provider and data processor of your information.

Collection of Information

We collect various information on our behalf from and about you, including information you directly provide when you use the Messaging Service. For example, we collect the phone number and email address you provided when signing up for the Messaging Service. When you send messages via the Messaging Service, we will also collect your messaging history and any information included in those messages.

We may also collect information about you using cookies or similar technologies. Cookies are pieces of information that are stored by your browser on the hard drive or memory of your device. Cookies enable personalization of your experience on the Messaging Service (e.g., sending you personalized text messages such as shopping cart reminders and order updates).

If you participate in a contest, sweepstakes, research study, or email survey associated with the Messaging Service, we will collect basic contact information and any other information you choose to provide in connection with these activities. We will also collect your contact information if you contact us with questions about the Messaging Service or for customer service.

Use of Information

We use your information to deliver, analyze, maintain and support the Messaging Service. We may also use your information to enhance the Messaging Service features and customize and personalize your experiences on the Messaging Service.

Sharing of Information

We may share, transfer, or disclose your information, if you consent to us doing so, as well as in the following circumstances:

  • Service Providers. We may share your information with third parties to help us provide the Messaging Service to you.
  • Legal Requirement and Protection of Iterable and Others. We may disclose your information as we believe such disclosure is necessary or appropriate to: (i) comply with applicable law and legal processes; (ii) respond to requests from public and government authorities, including public and government authorities outside your country of residence; (iii) enforce a contract with us; (iv) protect our rights, privacy, safety, or property, and/or that of our affiliates, you or others; and (v) allow us to pursue available remedies or limit the damages that we may sustain.

From time to time, we may share aggregate or de-identified information about use of the Messaging Service and such aggregated or de-identified information may be shared with any third party, including advertisers, promotional partners, and sponsors.

Protection of Information

We take a variety of physical, technical, administrative, and organizational security measures based on the sensitivity of the information we collect to protect your information against accidental or unlawful destruction or accidental loss, alteration, unauthorized disclosure or access. Unfortunately, no online activity can be guaranteed to be 100% secure. While we strive to protect your information against unauthorized use or disclosure, we cannot ensure or warrant the security of any information you provide. We do not accept liability for unintentional disclosure.

Retention of Information

We retain your information for as long as you participate in the Messaging Service or as needed to comply with applicable legal obligations. We will also retain and use your information as necessary to resolve disputes, protect us and our customers, and enforce our agreements.

Choices and Controls

Consent to receive automated marketing text messages is not a condition of any purchase. You can opt-out of receiving further commercial or transactional text messages via the Messaging Service by responding to any of our text messages with any of the following replies: STOP, END, CANCEL, UNSUBSCRIBE, or QUIT. For additional opt-out information, please review our Terms.

Main Privacy Policy

By signing up to receive text messages from us, you also agree to our main Privacy Policy.

Definitions

AGGREGATED DATA

Aggregated Data is data that has undergone a process whereby raw data is gathered and expressed in a summary form for statistical analysis. Raw data can be aggregated over a given time period, across individuals, or both, to provide statistics such as average, minimum, maximum, sum, and count. After the data is aggregated analysis can be performed to gain insights about particular data sets. When data is aggregated across a number of individuals, the resulting aggregation is considered anonymized such that it is no longer Personal Data. See our Privacy Policy here for more information on how we use Aggregated Data.

CCPA

The California Consumer Privacy Act, or CCPA, is a state law that provides California consumers with robust data privacy rights. These rights include the right to know, the right to delete, and the right to opt-out of “sale” of personal information that businesses collect, as well as additional protections for minors. A “sale” under the CCPA is defined as “selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer’s personal information by the business to another business or to a third party for monetary or other valuable consideration.” See our Privacy Policy here for more details on the information we may share with others.

COOKIES

Cookies are small files which are stored on a user’s computer. They are designed to hold a modest amount of data specific to a particular user and website, and can be accessed either by the web server or the user computer. This allows the server to deliver a page tailored to a particular user, or the page itself can contain some script which is aware of the data in the cookie and is therefore able to carry information from one visit to the website (or related site) to the next. See our Privacy Policy here to learn about cookies and how they are used on our websites.

DE-IDENTIFIED DATA

De-Identified Data is data where all the personally identifiable information has been removed, rendering the data anonymous by stripping out information that would allow an individual’s identity to be determined from the remaining data. Data is “de-identified” to protect the privacy and identity of individuals associated with the data. De-identified Data is no longer Personal Data. See our Privacy Policy here for more information on how we use De-identified Data.

GDPR

The General Data Protection Regulation, or GDPR, is a data privacy and security regulation under European law that sets guidelines for the collection and processing of personal information from individuals who live in the European Economic Area, Switzerland and United Kingdom (collectively, “Europe” or “European”). The GDPR provides data protection rights to European residents and applies to any organization that offers goods or services to individuals in Europe, even if that organization is not based in Europe. See our Privacy Policy here for more information on the data rights available to European residents.

IP ADDRESS

An IP Address is a unique address that identifies a device on the internet or a local network. It allows a system to be recognized by other systems connected via the internet protocol. An IP Address may be considered Personal Data and is at times used by advertisers to serve interest-based ads. See our Privacy Policy here for details on how we share Personal Data.

PERSONAL DATA

Personal Data is any data that identifies or relates to you as a particular individual, including information referred to as “personally identifiable information” or “personal information” under applicable data privacy laws, rules, or regulations. See our Privacy Policy here for an outline of the ways in which we use, collect, and share Personal Data.

SERVICES

Services means, collectively, our websites and mobile apps, any software embedded within the WHOOP Strap, and any features, content, or applications offered, from time to time, by WHOOP in connection therewith.

THIRD PARTIES

Third Parties in the context of the relationship between WHOOP, WHOOP Members (our end users), and third parties are entities or businesses involved in an arrangement, contract, deal, or transaction but are not one of the principals (i.e., WHOOP or WHOOP Members). We use Third Parties to enable us to do business with our members, such as charging for transactions or storing data. Third Parties also include advertisers that serve interest-based ads to visitors to our website. See our Privacy Policy here for more information on the Third Parties that do business with WHOOP.

WHOOP STRAP

Your WHOOP Strap is a wearable sensor that, when used in connection with the Services, collects certain types of Personal Data.

WHOOP, WE, US, OUR

The terms “WHOOP,” “we,” “us,” or “our” mean Whoop, Inc. and each of its wholly owned subsidiaries.

WELLNESS DATA

Wellness Data is (a) data collected by your WHOOP Strap and sent to the WHOOP platform, including your heart rate, heart rate variability, sleep duration, respiratory rate, skin temperature, blood oxygen saturation level, and data such as the type of activity you engage in and the duration of your physical activity; and (b) any additional information you chose to enter during the use of our Services, such as information about your health and wellness, including information collected from accounts, devices, or features that you link with your WHOOP account. See our Privacy Policy here for additional details on Wellness Data.

Security

How WHOOP handles security vulnerabilities

At WHOOP, our mission is to unlock human performance. We exist to improve the lives of our members, not invade their lives. Like all companies providing wearable devices and health monitoring services, WHOOP manages personal and sensitive data of our members. We take privacy seriously, and understand that we have a responsibility to protect the privacy of our members’ data. We understand that secure products are instrumental in maintaining the trust that members place in WHOOP, and we strive to create innovative products that improve our members' lives.

This site provides information for researchers and security professionals.

If you are a WHOOP member and are experiencing a security issue with your account please contact Membership Services.

Reporting security issues

WHOOP openly accepts vulnerability reports for our WHOOP platform and products. If you believe you have discovered a vulnerability in a WHOOP platform or product, or if you have a security incident to report, please contact us our vulnerability disclosure form below. Upon receipt of your message, we will send a reply that includes a tracking identifier. WHOOP will not engage in legal action against individuals who in good faith submit vulnerability reports through the methods listed above.

WHOOP Vulnerability Disclosure Policy

At WHOOP, we believe that vulnerability disclosure is a two-way street - both WHOOP and security researchers must act responsibly. This is why WHOOP adheres to a 90-day disclosure deadline (the “Deadline”). We notify vendors of vulnerabilities immediately, with details shared in public with the defensive community after the Deadline, or sooner if the vendor releases a fix. That Deadline can vary in the following ways:

As always, we reserve the right to bring the Deadline forward or backward based on extreme circumstances. We remain committed to treating all vendors strictly equally. WHOOP expects to be held to the same standard.

This policy aligns with our desire to improve industry response times to security bugs, but also results in softer landings for bugs marginally over the Deadline. WHOOP calls on all security researchers to adopt disclosure deadlines in some form, and welcomes security researchers to use this policy if you find our policy compelling. Creating pressure towards reasonably-timed fixes will result in smaller windows of opportunity for blackhats to abuse vulnerabilities. In our opinion, vulnerability disclosure policies such as ours result in greater overall safety for users of the Internet.

Submit Vulnerability Report

Submit

CCPA (CALIFORNIA CONSUMER PROTECTION ACT)

At WHOOP, we take the privacy of our Members and Customers seriously. We do not sell personal information.

Our Services provide and our partners use automated technologies, such as cookies, to understand how people use our products and Services and to support advertising. You can learn how to limit the use of these technologies in our Privacy Policy.

The CCPA also provides the following rights if you are a resident of the state of California: (1) the right to know how your personal information is collected and used; (2) the right to have access to and request the personal information collected; (3) the right to have your personal data deleted; and (4) 4he right to stop your personal information from being sold or shared. The CCPA limits these rights by, for example, prohibiting businesses from providing certain sensitive information in response to an access request and limiting the circumstances in which they must comply with a deletion request.

For privacy rights requests or questions about your privacy rights, please email us at privacy@whoop.com. Click here more on data management.

WHOOP Patents

WHOOP Patents

The WHOOP® products listed below are covered by at least the indicated US patents. Additional US patent applications and non-US patents may cover these products.

WHOOP 4.0

WHOOP 4.0 & WHOOP App

WHOOP Body

Minimum Advertised Pricing Policy

INTRODUCTION

The high quality of Whoop, Inc. (“WHOOP”) products and services (collectively, “Products”) is the direct result of our investment in innovation, engineering and design. WHOOP has spent years building an aspirational brand with high perceived value and strong recognition. WHOOP also recognizes that our success is tied to the success of our network of resellers, distributors, sales representatives or dealers (collectively, “Resellers”). We want to protect our Resellers investments in delivering an extraordinary customer experience, while also discouraging price-based advertising that would be detrimental to our Resellers’ service and support efforts. Therefore, WHOOP has unilaterally established this Minimum Advertised Price Policy (“MAP Policy”) for certain WHOOP Products sold by Resellers in the United States.

MAP POLICY

SCHEDULE A TO MAP POLICY

WHOOP Consumer Health Data Privacy Notice

WHOOP Consumer Health Data Privacy Notice

Last Updated: August 3, 2026

This Consumer Health Data Privacy Notice (“Notice”) describes how Whoop, Inc. (“WHOOP,” “we,” “our,” or “us”) collects, uses, and protects consumer health data about WHOOP members and other consumers who interact with WHOOP or use our services, including by visiting our websites or our social media pages or by using our mobile apps, the WHOOP Strap, another WHOOP device, or any features, content, or applications, such as Advanced Labs, offered by WHOOP in connection therewith (collectively, the “Services”). This Notice also outlines how such information may be shared with or used by third-party laboratory or clinical services, when applicable, and the privacy rights and choices you have with respect to such data. This Notice supplements the WHOOP Privacy Policy and applies to the extent required by applicable US state laws. In the event of a conflict between our Privacy Policy and this Notice, this Notice controls.

Categories of Consumer Health Data We Collect

Depending on your use of the Services, we may collect certain consumer health data about you that identifies your past or present physical or mental health status. The categories of consumer health data we collect include:

Information about your health conditions, treatments, or diagnoses, including details about your health history, hereditary or chronic conditions, prescribed medications, substance use or related disorders, as well as any other medical information you provide.

Social, psychological, behavioral, and lifestyle interventions, including your exercise routines, training and recovery goals, dietary and sleep habits, stress management practices, and other habit or wellness metrics you choose to share with us.

Information about your bodily functions, vital signs, and physiological measurements, including your weight, height, heart rate, respiratory rate, and other information collected directly through our Services or obtained from third parties, such as Apple Health or other integrated apps and devices, when you grant permission.

Diagnostic testing and biomarkers, including blood test results and laboratory test results (e.g., blood panels, biomarkers, diagnostic values) that you provide to us or that are shared with us when you use our Services. We will integrate and analyze these results with your other wellness data (such as sleep, training, and recovery metrics) to generate personalized insights.

Derived or inferred health information, including insights we generate from your provided data, such as biomarker-based health trends, estimated recovery readiness, risk scores, or personalized recommendations to support changes to your habits and improve your performance and overall wellness.

Sources of Consumer Health Data

We collect consumer health data about you from:

You

When you create an account, input information into our apps or devices, or upload health documentation such as blood test results or lab results.

Third parties

When you grant us permission to collect data from third parties, such as your Apple Health app or other apps or fitness trackers.

We may receive consumer health data from third-party laboratories and/or clinical partners when you direct them to share results with us.

Our Purposes For Collecting and Using Consumer Health Data

We collect and use your consumer health data in order to provide the Services, connect you to third parties and enhance the WHOOP experience, including:

Personalizing insights and health feedback based on your lab values;

Integrating your test results into existing performance metrics and trends;

Research and development to improve our Services, in a de-identified or aggregated form; and

Responding to requests from applicable regulatory authorities.

We do not sell your consumer health data to third parties. We may use your consumer health data to personalize the WHOOP experience, including recommendations, insights, and product features. Any personalization based on your health data occurs within WHOOP and is not used for third-party advertising. Where required by applicable law, we will obtain your consent before using consumer health data for marketing or promotional purposes. You can control how your health data is used to personalize your WHOOP experience in the WHOOP app by going to Privacy Settings. If you turn this setting off, we will no longer use your health data to personalize recommendations, offers, or similar features within WHOOP, which may affect certain features of the Services.

Data Sharing

We may share your consumer health data with:

Service providers or processors we collaborate in order to provide the Services, including third-party laboratory and clinical service providers when you direct us to obtain or integrate your test results, biomarkers, or other clinical data into our platform;

Law enforcement, government agencies or other third parties, where we believe in good faith it is necessary or appropriate to comply with applicable laws or protect our legitimate interests;

Business transferees, in the event of a merger, sale, acquisition, bankruptcy or other transaction in which that third party assumes control of our business or data (in whole or in part). Should one of these events occur, we will make reasonable efforts to notify you before your consumer health data becomes subject to different privacy and security policies and practices; and

Other third parties, with your consent or at your direction.

Retention

We retain your consumer health data for as long as necessary to provide our Services or as required by applicable law.

Your Rights

Depending on your state residency, you may have certain rights to:

Withdraw consent. To the extent we rely upon your consent for our collection, use or sharing of your consumer health data, you have the right to withdraw such consent from future collection, use or sharing.

Access and confirm. You have the right to ask us to confirm whether we have collected, shared or sold your consumer health data. You have the right to access the consumer health data that we have collected from or about you. You also have a right to access a list of all third parties we have shared your consumer health data with.

Correction. You have the right to ask us to correct inaccuracies in your consumer health data.

Deletion. You have the right to ask us to delete your consumer health data.

Appeal. You have the right to appeal our denying a right you have attempted to exercise. We will provide details on how to appeal our denial in connection with such action. If your appeal is denied, you may issue a complaint with appropriate regulatory enforcement authorities.

To request access to, or correction or deletion of consumer health data collected via your use of the Services, please either (i) use the “Data Management” feature available on the WHOOP Privacy Center at: privacy.whoop.com; or (ii) email us at privacy@whoop.com.

We will not discriminate against you for exercising your rights described above.

HIPAA

To the extent that we process your personal information in connection with our providing services on behalf of a “covered entity” under the Health Insurance Portability and Accountability Act, our processing of your personal information in that context will be governed by the Notice of Privacy Practices of the relevant covered entity. In the event of a conflict between our Privacy Policy and the relevant Notice of Privacy Practices, the relevant Notice of Privacy Practices will govern.

Contact Us

If you have any questions about this Notice or our privacy practices, you may contact us at:

WHOOP Privacy Team Email: privacy@whoop.com Whoop, Inc., Attn: Legal Department, One Kenmore Square, #601 Boston, MA 02215