WHOOP staff may access your personal data only with a legitimate business need
WHOOP says it is its policy that a member's personal data is not to be accessed or shared by anyone at WHOOP without an explicit need. It lists membership services representatives, management team members, data scientists and technical team members as people who are not permitted to access your personal data without a legitimate business need.
Supporting quotations
Our policy is that a member’s personal data is not to be accessed or shared by anyone at WHOOP without an explicit need to do so.
WHOOP membership services representatives, management team members, data scientists and technical team members are not permitted to access your personal data without a legitimate business need.
Qualifications & exceptions
The restriction turns on 'a legitimate business need' (and 'an explicit need' in the general statement); the passage does not define those terms or list the permitted needs.
Not stated here
Who decides what counts as a legitimate business need, and any independent checking of that decision, is not described in this section.
Security & Safeguards · Company practice
WHOOP logs who accesses member data and investigates anomalies
WHOOP says it maintains a log of who has accessed member personal data and when, and that it actively evaluates the data access logs and investigates any anomalies in data access.
Supporting quotations
We maintain a log that tells us who has accessed member personal data and when.
We actively evaluate data access logs and investigate any anomalies for data access.
Not stated here
How often logs are reviewed, who reviews them, and what follows an investigation are not stated.
Security & Safeguards · Company practice
WHOOP says it uses physical, technical, administrative and organizational security measures
WHOOP says it takes a variety of physical, technical, administrative and organizational security measures, based on the sensitivity of the information it collects, to protect your information against accidental or unlawful destruction, accidental loss, alteration, and unauthorized disclosure or access.
Supporting quotations
We take a variety of physical, technical, administrative, and organizational security measures based on the sensitivity of the information we collect to protect your information against accidental or unlawful destruction or accidental loss, alteration, unauthorized disclosure or access.
Qualifications & exceptions
The level of measures is tied to the sensitivity of the information collected.
Not stated here
The measures themselves are not described.
Security & Safeguards · Restriction or exception
WHOOP does not guarantee security and does not accept liability for unintentional disclosure
WHOOP says no online activity can be guaranteed to be 100% secure and that, although it strives to protect your information against unauthorized use or disclosure, it cannot ensure or warrant the security of any information you provide. It also states that it does not accept liability for unintentional disclosure.
Supporting quotations
Unfortunately, no online activity can be guaranteed to be 100% secure. While we strive to protect your information against unauthorized use or disclosure, we cannot ensure or warrant the security of any information you provide. We do not accept liability for unintentional disclosure.
Qualifications & exceptions
The liability statement is about unintentional disclosure; the passage does not address other kinds of disclosure.
Not stated here
How far this disclaimer is enforceable is a legal question outside what the document says.
Security & Safeguards · Context
The Security section is for researchers; members with account security issues should contact Membership Services
WHOOP says its security site provides information for researchers and security professionals, and that a WHOOP member experiencing a security issue with their account should contact Membership Services instead. The section opens by saying that WHOOP manages personal and sensitive data of its members like other companies providing wearable devices and health monitoring services, that it takes privacy seriously, and that it has a responsibility to protect the privacy of members' data.
Supporting quotations
If you are a WHOOP member and are experiencing a security issue with your account please contact
This site provides information for researchers and security professionals.
Like all companies providing wearable devices and health monitoring services, WHOOP manages personal and sensitive data of our members. We take privacy seriously, and understand that we have a responsibility to protect the privacy of our members’ data.
Qualifications & exceptions
The member route (Membership Services) is separate from the researcher route for vulnerability reports.
Not stated here
The introduction states values and responsibilities in general terms; it does not describe specific security controls.
Security & Safeguards · Procedure
WHOOP accepts vulnerability reports and sends back a tracking identifier
WHOOP says it openly accepts vulnerability reports for its WHOOP platform and products. If you believe you have found a vulnerability, or have a security incident to report, you are asked to contact WHOOP through its vulnerability disclosure form, and on receipt WHOOP says it will reply with a tracking identifier. The link at the end of the section, labelled Submit, points to a HackerOne page named whoop_bug_bounty.
Supporting quotations
WHOOP openly accepts vulnerability reports for our WHOOP platform and products. If you believe you have discovered a vulnerability in a WHOOP platform or product, or if you have a security incident to report, please contact us our vulnerability disclosure form below. Upon receipt of your message, we will send a reply that includes a tracking identifier.
The form is described as 'below' the text; the Submit link is at the end of the Security section.
Not stated here
The passage does not say how long WHOOP takes to respond beyond the tracking identifier reply, or what it does with reports.
Security & Safeguards · Company practice
WHOOP's disclosure policy uses a 90-day deadline that can move for weekends, pending patches or extreme circumstances
WHOOP says vulnerability disclosure is a two-way street and that it adheres to a 90-day disclosure deadline. It says it notifies vendors of vulnerabilities immediately, with details shared publicly with the defensive community after the Deadline, or sooner if the vendor releases a fix. The Deadline can vary: if it would expire on a weekend or U.S. public holiday it moves to the next regular work day; if a vendor says before the Deadline expires that a patch is scheduled within 14 days after the Deadline, WHOOP will delay public disclosure until the patch is available; and WHOOP reserves the right to bring the Deadline forward or backward based on extreme circumstances. It says it treats all vendors strictly equally and expects to be held to the same standard.
Supporting quotations
WHOOP adheres to a 90-day disclosure deadline (the “Deadline”). We notify vendors of vulnerabilities immediately, with details shared in public with the defensive community after the Deadline, or sooner if the vendor releases a fix. That Deadline can vary in the following ways:
If a Deadline is due to expire on a weekend or U.S. public holiday, the Deadline will be moved to the next regular work day.
Before the Deadline has expired, if a vendor lets us know that a patch is scheduled for release on a specific day that will fall within 14 days following the Deadline, we will delay the public disclosure until the availability of the patch.
As always, we reserve the right to bring the Deadline forward or backward based on extreme circumstances. We remain committed to treating all vendors strictly equally. WHOOP expects to be held to the same standard.
Qualifications & exceptions
The 14-day patch extension depends on the vendor telling WHOOP before the Deadline expires that a patch is scheduled for a specific day.
The reservation to move the Deadline is for 'extreme circumstances'.
Actively exploited, previously unknown vulnerabilities follow a shorter timeline (see the 7-day card).
Not stated here
The text is written about WHOOP notifying vendors of vulnerabilities and sharing details publicly; it does not spell out whether, and how, the same deadline applies to vulnerabilities reported to WHOOP about its own products.
Security & Safeguards · Company practice
For actively exploited unknown vulnerabilities, WHOOP uses a 7-day timeline before supporting disclosure
When WHOOP observes a previously unknown and unpatched vulnerability in software that is under active exploitation (a '0day'), it says more urgent action, within 7 days, is appropriate. It gives the reason that each day an actively exploited vulnerability stays undisclosed and unpatched, more devices or accounts are compromised. After 7 days without a patch or advisory, WHOOP says it will support researchers making details available so users can take steps to protect themselves. WHOOP acknowledges that seven days is aggressive and may be too short for some vendors to update their products.
Supporting quotations
When we observe a previously unknown and unpatched vulnerability in software under active exploitation (a “0day”), we believe that more urgent action - within 7 days - is appropriate.
after 7 days have elapsed without a patch or advisory, we will support researchers making details available so that users can take steps to protect themselves.
Qualifications & exceptions
The 7-day timeline applies to previously unknown, unpatched vulnerabilities in software under active exploitation that WHOOP observes.
WHOOP says the time should be enough to publish advice on mitigations such as temporarily disabling a service, restricting access or contacting the vendor.
Not stated here
The text does not say whether the 7-day path is used for vulnerabilities in WHOOP's own products.