WHOOP uses aggregated or de-identified wellness data for research, features and insights
Under a heading saying WHOOP uses only aggregated or de-identified wellness data to better understand human performance, WHOOP says it uses aggregated or de-identified wellness data that no longer identifies a particular individual, and which it therefore treats as no longer personal data, to help answer questions about human performance. It says it will look to provide new content and product features, improve and customize its services (including determining and reporting on trends, sleep, strain and recovery), and develop thought leadership on human performance.
Supporting quotations
WHOOP USES ONLY AGGREGATED OR DE-IDENTIFIED WELLNESS DATA TO BETTER UNDERSTAND HUMAN PERFORMANCE
We use aggregated or de-identified wellness data that no longer identifies a particular individual (and is thus no longer personal data) to help answer important questions about human performance
We will always look to provide new content and product features, improve and customize our services (including determining and reporting on trends, sleep, strain, and recovery), and develop thought leadership in the area of human performance.
Qualifications & exceptions
The 'only aggregated or de-identified' wording appears in the heading and relates to the human-performance research purpose described; the passage does not say that WHOOP uses no identifiable data to run the service itself.
WHOOP's statement that such data is 'no longer personal data' is its own characterization.
Not stated here
The methods used to aggregate or de-identify the data, and any safeguards against re-identification, are not described in this section.
Use & Processing · Context
The Messaging Privacy Policy covers WHOOP's text message programs, run with Iterable as processor
This policy explains how WHOOP collects and uses information about you in relation to its text message marketing and transactional programs, which it calls the Messaging Service. WHOOP says it uses Iterable to provide the Messaging Service and that, for the Messaging Service, Iterable acts as WHOOP's service provider and data processor of your information.
Supporting quotations
This Messaging Program Privacy Policy explains how WHOOP collects and uses information about you in relation to its text message marketing and transactional programs (the “Messaging Service”). We use Iterable to provide the Messaging Service to you. For the purposes of the Messaging Service, Iterable acts as our service provider and data processor of your information.
Qualifications & exceptions
The policy is limited to the text message programs; people who sign up also agree to WHOOP's main Privacy Policy (see the card on that sentence).
Not stated here
The passage does not say what Iterable may do with the information beyond acting as WHOOP's processor.
Use & Processing · Company practice
WHOOP uses your messaging information to run, analyze, support and personalize the service
WHOOP says it uses your information to deliver, analyze, maintain and support the Messaging Service, and that it may also use it to enhance the Messaging Service's features and to customize and personalize your experiences on it.
Supporting quotations
We use your information to deliver, analyze, maintain and support the Messaging Service. We may also use your information to enhance the Messaging Service features and customize and personalize your experiences on the Messaging Service.
Qualifications & exceptions
The delivery, analysis, maintenance and support uses are stated as things WHOOP does; enhancement and personalization are things it 'may' do.
Not stated here
The passage does not say whether this information is used outside the Messaging Service.
Use & Processing · Context
'Aggregated Data' is summarized data; aggregated across people, WHOOP treats it as no longer Personal Data
WHOOP defines Aggregated Data as data that has been gathered and expressed in summary form for statistical analysis, for example averages, minimums, maximums, sums and counts over a time period, across individuals, or both. It says that when data is aggregated across a number of individuals, the result is considered anonymized so that it is no longer Personal Data.
Supporting quotations
Aggregated Data is data that has undergone a process whereby raw data is gathered and expressed in a summary form for statistical analysis.
When data is aggregated across a number of individuals, the resulting aggregation is considered anonymized such that it is no longer Personal Data.
Qualifications & exceptions
The 'no longer Personal Data' result is stated for data aggregated across a number of individuals; aggregation over time alone is not given that result in this definition.
The definition is WHOOP's own, and the Privacy Principles and Messaging policy rely on aggregated or de-identified information.
Not stated here
The definition does not say how many individuals must be included, or what safeguards apply, for aggregated data to be treated as anonymized.
Use & Processing · Context
'De-Identified Data' has personal identifiers removed and is treated as no longer Personal Data
WHOOP defines De-Identified Data as data from which all personally identifiable information has been removed, rendering it anonymous by stripping out information that would allow an individual's identity to be determined from the remaining data. It says De-Identified Data is no longer Personal Data.
Supporting quotations
De-Identified Data is data where all the personally identifiable information has been removed, rendering the data anonymous by stripping out information that would allow an individual’s identity to be determined from the remaining data.
De-identified Data is no longer Personal Data.
Qualifications & exceptions
The definition is WHOOP's own; the Privacy Principles and Messaging policy rely on aggregated or de-identified information.
Not stated here
The definition does not describe the method used or any protection against re-identification.
Use & Processing · Company practice
Blood and lab test results you provide are collected and combined with your other wellness data
WHOOP lists diagnostic testing and biomarkers, including blood test results and laboratory test results such as blood panels, biomarkers and diagnostic values, that you provide to WHOOP or that are shared with WHOOP when you use the Services. It says it will integrate and analyze these results with your other wellness data, such as sleep, training and recovery metrics, to generate personalized insights.
Supporting quotations
Diagnostic testing and biomarkers, including blood test results and laboratory test results (e.g., blood panels, biomarkers, diagnostic values) that you provide to us or that are shared with us when you use our Services. We will integrate and analyze these results with your other wellness data (such as sleep, training, and recovery metrics) to generate personalized insights.
Qualifications & exceptions
Results are either provided by you or shared with WHOOP when you use the Services.
Not stated here
The notice does not say how long lab results are kept beyond the general retention statement later in this Notice.
Use & Processing · Company practice
WHOOP uses consumer health data to provide the Services, connect you to third parties and enhance the experience
WHOOP says it collects and uses your consumer health data to provide the Services, connect you to third parties and enhance the WHOOP experience, including: personalizing insights and health feedback based on your lab values; integrating your test results into existing performance metrics and trends; research and development to improve its Services in a de-identified or aggregated form; and responding to requests from applicable regulatory authorities.
Supporting quotations
We collect and use your consumer health data in order to provide the Services, connect you to third parties and enhance the WHOOP experience, including:
Personalizing insights and health feedback based on your lab values;
Integrating your test results into existing performance metrics and trends;
Research and development to improve our Services, in a de-identified or aggregated form; and
Responding to requests from applicable regulatory authorities.
Qualifications & exceptions
The research and development use is described as being in de-identified or aggregated form.
The word 'including' signals the list is not exhaustive.
Not stated here
'Connect you to third parties' is not explained further in this section.
Use & Processing · User right or choice
You can switch off health-data personalization in Privacy Settings, which may affect some features
WHOOP says you can control how your health data is used to personalize your WHOOP experience in the WHOOP app by going to Privacy Settings. If you turn this setting off, WHOOP says it will no longer use your health data to personalize recommendations, offers or similar features within WHOOP, which may affect certain features of the Services.
Supporting quotations
You can control how your health data is used to personalize your WHOOP experience in the WHOOP app by going to Privacy Settings. If you turn this setting off, we will no longer use your health data to personalize recommendations, offers, or similar features within WHOOP, which may affect certain features of the Services.
Qualifications & exceptions
Turning the setting off stops personalization of recommendations, offers and similar features; it is not described as deleting data or stopping other uses.
Not stated here
The section does not say which features are affected or whether the setting stops the other uses described in this Notice.