Privacy Principles summarize WHOOP's approach; the full Privacy Policy holds the detail
This opening section presents WHOOP's Privacy Principles. WHOOP says it wants members to understand how it uses, collects and shares personal data and the measures it takes to protect it, and that it continually evaluates its privacy practices to align them with applicable privacy laws, naming the California Consumer Privacy Act (CCPA) and the General Data Protection Regulation (GDPR). For more detailed information about how personal data is used, collected and shared, the principles send readers to WHOOP's full Privacy Policy.
Supporting quotations
We continually evaluate our privacy practices to align them with applicable privacy laws including the California Consumer Privacy Act (“CCPA”) and the General Data Protection Regulation (“GDPR”).
You can find more detailed information about ways in which we use, collect, and share personal data in our full
Qualifications & exceptions
Saying practices are evaluated 'to align' with these laws is a statement of intent, not a statement of what a particular law requires in a particular case.
The principles section itself is a summary; the detail on collection, use and sharing lives in the full Privacy Policy.
Not stated here
The full Privacy Policy is a linked document and its text is not part of this analysis, so the detail it contains is unknown here.
Legal Rights & Agreement Rules · Company commitment
WHOOP says it will email you if it receives a request for your data
WHOOP says that if it receives a request for a member's data, it will notify the member by sending an email to the email address it has on file for that member.
Supporting quotations
If WHOOP receives a request for a members data, we will provide notice to the member by sending an email to the email address we have on file for that member.
Qualifications & exceptions
Notice goes to the email address WHOOP has on file, so an out-of-date address would affect whether the member sees it.
Not stated here
The passage states no timing for the notice and no situations in which notice might be withheld or delayed.
Legal Rights & Agreement Rules · Context
WHOOP's Privacy Officer is its General Counsel, reachable at privacy@whoop.com
WHOOP names its Privacy Officer, and equivalent roles globally, as its General Counsel, Travis Lang, who can be reached at privacy@whoop.com.
Supporting quotations
Our Privacy Officer (and equivalent roles globally) is Travis Lang, General Counsel, who can be reached at
Not stated here
The passage names the officer and the contact address; it does not describe what the Privacy Officer is responsible for.
Legal Rights & Agreement Rules · Context
The Privacy Principles also apply to WHOOP Coach, with details in a linked article
WHOOP says that for more information about how its Privacy Principles apply to WHOOP Coach, readers should follow a link to a separate support article.
Supporting quotations
For more information about how these principles apply to WHOOP Coach, please read
Not stated here
The linked support article about the AI-powered WHOOP Coach is a separate document and is not part of this analysis, so how the principles apply to WHOOP Coach is unknown here.
Legal Rights & Agreement Rules · Restriction or exception
Signing up for WHOOP texts also means you agree to WHOOP's main Privacy Policy
WHOOP says that by signing up to receive text messages from it, you also agree to its main Privacy Policy.
Supporting quotations
By signing up to receive text messages from us, you also agree to our main
Qualifications & exceptions
The agreement is triggered by signing up for the text messages.
Not stated here
The sentence points to a linked 'main Privacy Policy' without saying which of WHOOP's privacy documents that is, and that document is not part of this analysis.
Legal Rights & Agreement Rules · Context
The CCPA definition names California rights and quotes the law's broad meaning of 'sale'
WHOOP describes the California Consumer Privacy Act as a state law giving California consumers data privacy rights, including the right to know, the right to delete, and the right to opt out of 'sale' of personal information, as well as additional protections for minors. It quotes the CCPA's definition of a 'sale' as selling, renting, releasing, disclosing, disseminating, making available, transferring or otherwise communicating a consumer's personal information by the business to another business or a third party for monetary or other valuable consideration.
Supporting quotations
The California Consumer Privacy Act, or CCPA, is a state law that provides California consumers with robust data privacy rights. These rights include the right to know, the right to delete, and the right to opt-out of “sale” of personal information that businesses collect, as well as additional protections for minors.
A “sale” under the CCPA is defined as “selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer’s personal information by the business to another business or to a third party for monetary or other valuable consideration.”
Qualifications & exceptions
The quoted definition of 'sale' reaches transfers for 'monetary or other valuable consideration', not only payments of money.
WHOOP points to its Privacy Policy for more details on the information it may share with others.
Not stated here
WHOOP's own reading of how the CCPA definition applies to its practices is not stated in this definitions entry; the Privacy Principles say only that, because of the definition's breadth, WHOOP discloses its use of third-party cookies and tracking.
Legal Rights & Agreement Rules · Context
The GDPR definition covers European residents; details are in the full Privacy Policy
WHOOP describes the GDPR as a European data privacy and security regulation that sets guidelines for collecting and processing personal information of individuals who live in the European Economic Area, Switzerland and the United Kingdom, which it collectively calls 'Europe'. It says the GDPR gives European residents data protection rights and applies to any organization that offers goods or services to individuals in Europe, even if not based there.
Supporting quotations
The General Data Protection Regulation, or GDPR, is a data privacy and security regulation under European law that sets guidelines for the collection and processing of personal information from individuals who live in the European Economic Area, Switzerland and United Kingdom (collectively, “Europe” or “European”).
The GDPR provides data protection rights to European residents and applies to any organization that offers goods or services to individuals in Europe, even if that organization is not based in Europe.
Qualifications & exceptions
The entry is a description of the regulation, not a statement of the specific rights WHOOP provides.
Not stated here
The rights available to European residents are said to be in the Privacy Policy, which is a linked document not part of this analysis.
Legal Rights & Agreement Rules · Context
'Services' means WHOOP's websites, mobile apps, strap software and related features
WHOOP defines Services collectively as its websites and mobile apps, any software embedded within the WHOOP Strap, and any features, content or applications that WHOOP offers from time to time in connection with them.
Supporting quotations
Services means, collectively, our websites and mobile apps, any software embedded within the WHOOP Strap, and any features, content, or applications offered, from time to time, by WHOOP in connection therewith.
Qualifications & exceptions
The definition reaches features, content and applications offered 'from time to time', so it covers later additions.
Legal Rights & Agreement Rules · Context
'WHOOP,' 'we,' 'us' and 'our' mean Whoop, Inc. and its wholly owned subsidiaries
WHOOP defines the terms 'WHOOP,' 'we,' 'us' and 'our' to mean Whoop, Inc. and each of its wholly owned subsidiaries.
Supporting quotations
The terms “WHOOP,” “we,” “us,” or “our” mean Whoop, Inc. and each of its wholly owned subsidiaries.
WHOOP, WE, US, OUR
Qualifications & exceptions
The definition covers wholly owned subsidiaries; companies that are not wholly owned are not mentioned.
Legal Rights & Agreement Rules · Company commitment
WHOOP will not take legal action against good-faith vulnerability reporters who use its listed methods
WHOOP says it will not engage in legal action against individuals who in good faith submit vulnerability reports through the methods listed in the section.
Supporting quotations
WHOOP will not engage in legal action against individuals who in good faith submit vulnerability reports through the methods listed above.
Qualifications & exceptions
The commitment depends on two conditions: the report is submitted in good faith, and it goes through the methods listed.
The text says 'listed above' while the disclosure form is described as 'below', so the exact set of listed methods is not entirely clear.
Not stated here
The commitment does not define 'good faith' or say what happens to someone who discloses a vulnerability by other routes.
Legal Rights & Agreement Rules · Restriction or exception
WHOOP alone decides violations and sanctions, and may enforce without notice, up to ending the reseller agreement
WHOOP says it is solely responsible for deciding whether a violation of the MAP Policy has occurred and what sanctions are appropriate, and that WHOOP marketing or sales personnel are not authorized to negotiate, amend, modify, waive or grant exceptions to the policy. WHOOP will enforce the policy in its sole discretion and without notice. A Reseller has no right to enforce the policy. In addition to any remedies available at law, violations may result in notification of a violation, cancellation of pending Reseller orders, restrictions on future orders, suspension of a Reseller's account, or termination of any agreement with the Reseller.
Supporting quotations
WHOOP is solely responsible for determining whether a violation of the MAP Policy has occurred and determining appropriate sanctions. WHOOP marketing or sales personnel are not authorized to negotiate, amend, modify, waive or grant exceptions to the MAP Policy.
WHOOP will enforce this MAP Policy in its sole discretion and without notice. A Reseller has no right to enforce the MAP Policy. In addition to any available remedies WHOOP may have at law, violations of this MAP Policy may result in sanctions such as notification of a violation, cancellation of pending Reseller orders, restrictions on future Reseller orders, suspension of a Reseller’s account, cancellation of pending Reseller orders, or termination of any agreement with the Reseller.
Qualifications & exceptions
Sanctions are listed as things that 'may' result, in addition to any remedies WHOOP may have at law.
Enforcement may happen without notice to the Reseller.
Not stated here
The policy does not describe any appeal or dispute process for a Reseller.
Legal Rights & Agreement Rules · Restriction or exception
This Notice supplements the Privacy Policy and controls if the two conflict
WHOOP says this Notice supplements the WHOOP Privacy Policy and applies to the extent required by applicable US state laws. If there is a conflict between the Privacy Policy and this Notice, the Notice controls.
Supporting quotations
This Notice supplements the WHOOP Privacy Policy and applies to the extent required by applicable US state laws. In the event of a conflict between our Privacy Policy and this Notice, this Notice controls.
Qualifications & exceptions
The Notice controls in a conflict with the Privacy Policy; the Notice itself refers to a separate rule for processing on behalf of a HIPAA covered entity later in the document.
Not stated here
The Privacy Policy is a linked document that is not part of this analysis, so which of its terms might conflict is not known here.
Legal Rights & Agreement Rules · Restriction or exception
If WHOOP processes data for a HIPAA covered entity, that entity's privacy notice governs
To the extent WHOOP processes your personal information while providing services on behalf of a 'covered entity' under the Health Insurance Portability and Accountability Act (HIPAA), WHOOP says that processing is governed by the covered entity's Notice of Privacy Practices. If the WHOOP Privacy Policy and that Notice of Privacy Practices conflict, the covered entity's Notice of Privacy Practices governs. Elsewhere in this Notice, a conflict between the WHOOP Privacy Policy and this Consumer Health Data Notice is resolved in favor of this Notice.
Supporting quotations
To the extent that we process your personal information in connection with our providing services on behalf of a “covered entity” under the Health Insurance Portability and Accountability Act, our processing of your personal information in that context will be governed by the Notice of Privacy Practices of the relevant covered entity. In the event of a conflict between our Privacy Policy and the relevant Notice of Privacy Practices, the relevant Notice of Privacy Practices will govern.
In the event of a conflict between our Privacy Policy and this Notice, this Notice controls.
Qualifications & exceptions
This rule applies only to processing done on behalf of a HIPAA covered entity.
It is a narrower situation than the general rule that this Notice controls over the Privacy Policy.
Not stated here
The covered entity's Notice of Privacy Practices is a separate document and is not part of this analysis; WHOOP's Connected Care documents are separate agreements on the same site.
Cross-references
narrows (model-proposed): This Notice supplements the Privacy Policy and controls if the two conflict — exception_to: The Notice controls over the Privacy Policy in a conflict, except that for processing on behalf of a HIPAA covered entity, the covered entity's Notice of Privacy Practices governs a conflict with the Privacy Policy.