Privacy Policies — Privacy Principles, Messaging Privacy Policy, CCPA and Consumer Health Data Privacy Notice

Legal Rights & Agreement Rules · Context

Privacy Principles summarize WHOOP's approach; the full Privacy Policy holds the detail

This opening section presents WHOOP's Privacy Principles. WHOOP says it wants members to understand how it uses, collects and shares personal data and the measures it takes to protect it, and that it continually evaluates its privacy practices to align them with applicable privacy laws, naming the California Consumer Privacy Act (CCPA) and the General Data Protection Regulation (GDPR). For more detailed information about how personal data is used, collected and shared, the principles send readers to WHOOP's full Privacy Policy.

Supporting quotations

We continually evaluate our privacy practices to align them with applicable privacy laws including the California Consumer Privacy Act (“CCPA”) and the General Data Protection Regulation (“GDPR”).

You can find more detailed information about ways in which we use, collect, and share personal data in our full

Qualifications & exceptions

• Saying practices are evaluated 'to align' with these laws is a statement of intent, not a statement of what a particular law requires in a particular case.
• The principles section itself is a summary; the detail on collection, use and sharing lives in the full Privacy Policy.

Not stated here

• The full Privacy Policy is a linked document and its text is not part of this analysis, so the detail it contains is unknown here.

Account & Service Control · User right or choice

WHOOP says it will delete your personal data, or give you access to it, if you ask

WHOOP states that it will delete your personal data if you ask, including if you ask when you cancel your membership, and that it will give you access to your personal data if you ask, again including when you cancel. A self-serve route is described: you can delete your WHOOP data at any time through self-serve options in the WHOOP app or in the data management section of whoop.com.

Supporting quotations

We will delete your personal data if you ask us to, including if asked when you cancel your membership.

We will provide you with access to your personal data if you ask us to, including if asked when you cancel your membership.

you can delete it at any time by exercising our self-serve options, either in the WHOOP app or navigating to the

Qualifications & exceptions

• Both promises are triggered by the member asking; the principles say nothing here about WHOOP deleting data on its own initiative.
• Deletion is described as reachable at any time through the app or the data management section of whoop.com.

Not stated here

• These principles do not state a response time, any exceptions, or what happens to data WHOOP may be required to keep; other sections of this page describe how requests are made and some legal limits, but the principles do not restate them.

Cross-references

• contrast (model-proposed): California residents have CCPA rights to know, access, delete and stop sale, with CCPA limits — contrast: The Privacy Principles say WHOOP will delete personal data if asked, without stating exceptions, while the CCPA section says the CCPA limits the circumstances in which businesses must comply with a deletion request. The page does not say whether WHOOP applies those limits to its deletion promise.
• contrast (model-proposed): WHOOP keeps messaging information while you participate, as law requires, and as needed for disputes — contrast: The Privacy Principles say WHOOP will delete personal data if asked, while the Messaging Privacy Policy says WHOOP will retain and use information as necessary to resolve disputes, protect itself and its customers, and enforce its agreements. The page does not say whether a deletion request overrides that retention for messaging information.

Sharing & Disclosure · Company commitment

Beyond what the Privacy Policy describes, WHOOP says it shares your data only if you ask

WHOOP says its Privacy Policy describes how it shares personal data and that it will otherwise share your personal data with others only if you ask it to. The example given is sharing with an organization that manages a corporate wellness program, which WHOOP would do if you specifically authorized it.

Supporting quotations

Our Privacy Policy describes how we share personal data. We will otherwise share your personal data with others only if you ask us to. For example, we would share it with an organization managing a corporate wellness program if you specifically authorized us to do so.

Qualifications & exceptions

• The commitment is framed around sharing 'otherwise' than as the Privacy Policy describes, so it depends on what that policy allows.
• The corporate wellness example requires your specific authorization.

Not stated here

• What sharing the full Privacy Policy permits is not in this analysis, so the size of the 'otherwise' category cannot be judged here.

Security & Safeguards · Company commitment

WHOOP staff may access your personal data only with a legitimate business need

WHOOP says it is its policy that a member's personal data is not to be accessed or shared by anyone at WHOOP without an explicit need. It lists membership services representatives, management team members, data scientists and technical team members as people who are not permitted to access your personal data without a legitimate business need.

Supporting quotations

Our policy is that a member’s personal data is not to be accessed or shared by anyone at WHOOP without an explicit need to do so.

WHOOP membership services representatives, management team members, data scientists and technical team members are not permitted to access your personal data without a legitimate business need.

Qualifications & exceptions

• The restriction turns on 'a legitimate business need' (and 'an explicit need' in the general statement); the passage does not define those terms or list the permitted needs.

Not stated here

• Who decides what counts as a legitimate business need, and any independent checking of that decision, is not described in this section.

Security & Safeguards · Company practice

WHOOP logs who accesses member data and investigates anomalies

WHOOP says it maintains a log of who has accessed member personal data and when, and that it actively evaluates the data access logs and investigates any anomalies in data access.

Supporting quotations

We maintain a log that tells us who has accessed member personal data and when.

We actively evaluate data access logs and investigate any anomalies for data access.

Not stated here

• How often logs are reviewed, who reviews them, and what follows an investigation are not stated.

Sharing & Disclosure · Company commitment

WHOOP says it never sells member data, while confirming third-party cookies and tracking

Under the heading that WHOOP does not sell member personal data, WHOOP says it never sells its members' personal data and calls this its promise. In the same passage it says that, because the CCPA defines 'sale' so broadly, it wants to be clear that it uses third-party cookies and other tracking technologies. The CCPA section later on the page repeats that WHOOP does not sell personal information and adds that WHOOP's services provide, and its partners use, automated technologies such as cookies to understand how people use its products and services and to support advertising.

Supporting quotations

WHOOP DOES NOT SELL MEMBER PERSONAL DATA

we never sell our members’ personal data. This is our promise.

Because of how broadly the CCPA defines “sale,” we want to be clear that we use third party cookies and other tracking technologies.

We do not sell personal information.

Our Services provide and our partners use automated technologies, such as cookies, to understand how people use our products and Services and to support advertising.

Qualifications & exceptions

• The no-sale promise is made about members' personal data; WHOOP separately acknowledges third-party cookies and tracking technologies and, in the CCPA section, advertising support.

Not stated here

• The passage does not say whether WHOOP treats any cookie-based or advertising data flow as a 'sale' under the CCPA, so the practical effect of the promise on those flows is not stated here.
• How to limit these technologies is left to the full Privacy Policy, which is not part of this analysis.

Data Access & Collection · Company practice

WHOOP collects physiological 'wellness data' from the strap, plus anything you enter

WHOOP describes the data its strap collects from members as including heart rate, heart rate variability, sleep duration, respiratory rate, skin temperature, blood oxygen saturation level, the type of activity engaged in and its duration, and any additional information members choose to enter when using WHOOP services. Together this is called 'wellness data'.

Supporting quotations

This information includes heart rate, heart rate variability, sleep duration, respiratory rate, skin temperature, blood oxygen saturation level, data such as the type of activity engaged in and the duration of physical activity, and any additional information members chose to enter when using WHOOP services (collectively, “wellness data”).

Qualifications & exceptions

• 'Wellness data' is the term WHOOP uses in the Privacy Principles; the Definitions section later on the page gives a similar but longer definition that also covers data linked from other accounts and devices.

Use & Processing · Company practice

WHOOP uses aggregated or de-identified wellness data for research, features and insights

Under a heading saying WHOOP uses only aggregated or de-identified wellness data to better understand human performance, WHOOP says it uses aggregated or de-identified wellness data that no longer identifies a particular individual, and which it therefore treats as no longer personal data, to help answer questions about human performance. It says it will look to provide new content and product features, improve and customize its services (including determining and reporting on trends, sleep, strain and recovery), and develop thought leadership on human performance.

Supporting quotations

WHOOP USES ONLY AGGREGATED OR DE-IDENTIFIED WELLNESS DATA TO BETTER UNDERSTAND HUMAN PERFORMANCE

We use aggregated or de-identified wellness data that no longer identifies a particular individual (and is thus no longer personal data) to help answer important questions about human performance

We will always look to provide new content and product features, improve and customize our services (including determining and reporting on trends, sleep, strain, and recovery), and develop thought leadership in the area of human performance.

Qualifications & exceptions

• The 'only aggregated or de-identified' wording appears in the heading and relates to the human-performance research purpose described; the passage does not say that WHOOP uses no identifiable data to run the service itself.
• WHOOP's statement that such data is 'no longer personal data' is its own characterization.

Not stated here

• The methods used to aggregate or de-identify the data, and any safeguards against re-identification, are not described in this section.

Sharing & Disclosure · Company commitment

WHOOP says it will never voluntarily disclose member data to authorities or litigants

WHOOP notes that it may receive requests for member data from governmental entities, including law enforcement, and from private parties engaged in civil litigation. It says it will never voluntarily disclose member data in response to such a request by a governmental entity or civil litigant, and will never give any governmental entity or civil litigant direct access to its members' data.

Supporting quotations

Like all other companies, WHOOP may from time to time receive requests for member data from third parties, like governmental entities (including law enforcement) and private parties engaged in civil litigation.

WHOOP will never voluntarily disclose member data in response to a request by a governmental entity or civil litigant.

WHOOP will never provide any governmental entity or civil litigant with direct access to our members data.

Qualifications & exceptions

• The commitments are about responding to requests from governmental entities and civil litigants; they sit alongside the stricter-conditions commitment on copies in the next card.

Not stated here

• Other sections of this page (the Messaging Privacy Policy and the Consumer Health Data Privacy Notice) describe disclosures to authorities on a good-faith belief that disclosure is necessary or appropriate; these principles do not address how those statements fit together.

Cross-references

• contrast (model-proposed): WHOOP may disclose messaging information to comply with law, answer authorities or protect rights — contrast: The Privacy Principles say WHOOP will never voluntarily disclose member data in response to a governmental or litigant request, while the Messaging Privacy Policy says WHOOP may disclose information to respond to requests from public and government authorities when it believes disclosure is necessary or appropriate. The page does not say how the two fit together; they cover different data (member data generally versus Messaging Service information).
• contrast (model-proposed): WHOOP may share consumer health data with authorities or other third parties on a good-faith belief it is necessary — contrast: The Privacy Principles say WHOOP will never voluntarily disclose member data in response to a governmental or litigant request, while the Consumer Health Data Privacy Notice says WHOOP may share consumer health data with law enforcement and government agencies where it believes in good faith that this is necessary or appropriate. The page does not reconcile the two; the Notice's priority clause names only the Privacy Policy.

Sharing & Disclosure · Company commitment

Copies of member data go to authorities or litigants only on a valid, binding, narrow request

WHOOP says it will never provide copies of member data to any governmental entity or civil litigant without a valid, narrowly tailored and legally binding request, with a subpoena, warrant or court order given as examples. It says it is prepared to fight to protect its members' privacy in court if necessary, and will reject, challenge or object to any data access request from a governmental entity or civil litigant that it believes is invalid, overly broad, unclear or otherwise inappropriate.

Supporting quotations

WHOOP will never provide copies of member data held by WHOOP to any governmental entity or civil litigant without a valid, narrowly tailored, and legally-binding request (e.g., subpoena, warrant or court order).

WHOOP is prepared to fight to protect our members privacy in court if necessary. We will reject, challenge or object to any data access request from a governmental entity or civil litigant that we believe is invalid, overly broad, unclear or otherwise inappropriate.

Qualifications & exceptions

• Subpoena, warrant and court order are listed as examples ('e.g.'), not as an exhaustive list of qualifying requests.
• The commitment to challenge applies to requests WHOOP itself believes are invalid, overly broad, unclear or otherwise inappropriate.

Not stated here

• The passage does not say what WHOOP does with a request it considers valid beyond not providing copies without one.

Legal Rights & Agreement Rules · Company commitment

WHOOP says it will email you if it receives a request for your data

WHOOP says that if it receives a request for a member's data, it will notify the member by sending an email to the email address it has on file for that member.

Supporting quotations

If WHOOP receives a request for a members data, we will provide notice to the member by sending an email to the email address we have on file for that member.

Qualifications & exceptions

• Notice goes to the email address WHOOP has on file, so an out-of-date address would affect whether the member sees it.

Not stated here

• The passage states no timing for the notice and no situations in which notice might be withheld or delayed.

Account & Service Control · Procedure

Ask for access or deletion through Data Management, the app, or privacy@whoop.com

To request access to, or deletion of, personal data collected through your use of WHOOP's Services, WHOOP points you to the 'Data Management' feature on the WHOOP Privacy Center or to email at privacy@whoop.com. For consumer health data, the same two routes are listed and the request can also be for correction. Separately, the principles describe self-serve deletion at any time in the WHOOP app or the data management section of whoop.com. 'Services' is defined as WHOOP's websites and mobile apps, any software embedded within the WHOOP Strap, and any features, content or applications WHOOP offers in connection with them.

Supporting quotations

To request access to or deletion of Personal Data collected via your use of the Services, please either (i) use the “Data Management” feature available on the WHOOP Privacy Center

To request access to, or correction or deletion of consumer health data collected via your use of the Services, please either (i) use the “Data Management” feature available on the WHOOP Privacy Center at:

you can delete it at any time by exercising our self-serve options, either in the WHOOP app or navigating to the

Services means, collectively, our websites and mobile apps, any software embedded within the WHOOP Strap, and any features, content, or applications offered, from time to time, by WHOOP in connection therewith.

Qualifications & exceptions

• The consumer health data route lists correction as well as access and deletion; the general Privacy Inquiries sentence lists access and deletion only.
• Self-serve deletion is described for deleting your WHOOP data at any time in the app or the data management section of whoop.com.

Not stated here

• Verification steps, response times and appeal handling for these requests are not described in this section.

Legal Rights & Agreement Rules · Context

WHOOP's Privacy Officer is its General Counsel, reachable at privacy@whoop.com

WHOOP names its Privacy Officer, and equivalent roles globally, as its General Counsel, Travis Lang, who can be reached at privacy@whoop.com.

Supporting quotations

Our Privacy Officer (and equivalent roles globally) is Travis Lang, General Counsel, who can be reached at

Not stated here

• The passage names the officer and the contact address; it does not describe what the Privacy Officer is responsible for.

Legal Rights & Agreement Rules · Context

The Privacy Principles also apply to WHOOP Coach, with details in a linked article

WHOOP says that for more information about how its Privacy Principles apply to WHOOP Coach, readers should follow a link to a separate support article.

Supporting quotations

For more information about how these principles apply to WHOOP Coach, please read

Not stated here

• The linked support article about the AI-powered WHOOP Coach is a separate document and is not part of this analysis, so how the principles apply to WHOOP Coach is unknown here.

Use & Processing · Context

The Messaging Privacy Policy covers WHOOP's text message programs, run with Iterable as processor

This policy explains how WHOOP collects and uses information about you in relation to its text message marketing and transactional programs, which it calls the Messaging Service. WHOOP says it uses Iterable to provide the Messaging Service and that, for the Messaging Service, Iterable acts as WHOOP's service provider and data processor of your information.

Supporting quotations

This Messaging Program Privacy Policy explains how WHOOP collects and uses information about you in relation to its text message marketing and transactional programs (the “Messaging Service”). We use Iterable to provide the Messaging Service to you. For the purposes of the Messaging Service, Iterable acts as our service provider and data processor of your information.

Qualifications & exceptions

• The policy is limited to the text message programs; people who sign up also agree to WHOOP's main Privacy Policy (see the card on that sentence).

Not stated here

• The passage does not say what Iterable may do with the information beyond acting as WHOOP's processor.

Data Access & Collection · Company practice

The Messaging Service collects your phone number, email, message history and message content

WHOOP says it collects information from and about you, including information you provide when you use the Messaging Service. It gives as examples the phone number and email address you provided when signing up. When you send messages through the Messaging Service, it also collects your messaging history and any information included in those messages.

Supporting quotations

We collect various information on our behalf from and about you, including information you directly provide when you use the Messaging Service. For example, we collect the phone number and email address you provided when signing up for the Messaging Service. When you send messages via the Messaging Service, we will also collect your messaging history and any information included in those messages.

Qualifications & exceptions

• 'Including' and 'for example' show the list is illustrative, not complete.

Not stated here

• The passage does not list every kind of information collected.

Data Access & Collection · Company practice

WHOOP may use cookies to personalize your text messages, such as cart reminders

WHOOP says it may also collect information about you using cookies or similar technologies, which are pieces of information stored by your browser on your device. It says cookies enable personalization of your experience on the Messaging Service, for example sending personalized text messages such as shopping cart reminders and order updates.

Supporting quotations

We may also collect information about you using cookies or similar technologies.

Cookies enable personalization of your experience on the Messaging Service (e.g., sending you personalized text messages such as shopping cart reminders and order updates).

Qualifications & exceptions

• The statement is phrased as something WHOOP 'may' do.

Not stated here

• The passage does not say which cookies or similar technologies are used or how long they last.

Data Access & Collection · Company practice

Entering contests or surveys, or contacting WHOOP, means WHOOP collects your contact details

If you take part in a contest, sweepstakes, research study or email survey associated with the Messaging Service, WHOOP says it collects basic contact information and anything else you choose to provide for those activities. It also collects your contact information if you contact it with questions about the Messaging Service or for customer service.

Supporting quotations

If you participate in a contest, sweepstakes, research study, or email survey associated with the Messaging Service, we will collect basic contact information and any other information you choose to provide in connection with these activities. We will also collect your contact information if you contact us with questions about the Messaging Service or for customer service.

Use & Processing · Company practice

WHOOP uses your messaging information to run, analyze, support and personalize the service

WHOOP says it uses your information to deliver, analyze, maintain and support the Messaging Service, and that it may also use it to enhance the Messaging Service's features and to customize and personalize your experiences on it.

Supporting quotations

We use your information to deliver, analyze, maintain and support the Messaging Service. We may also use your information to enhance the Messaging Service features and customize and personalize your experiences on the Messaging Service.

Qualifications & exceptions

• The delivery, analysis, maintenance and support uses are stated as things WHOOP does; enhancement and personalization are things it 'may' do.

Not stated here

• The passage does not say whether this information is used outside the Messaging Service.

Sharing & Disclosure · Permission or license

WHOOP may share your messaging information with consent or with service providers

WHOOP says it may share, transfer or disclose your information if you consent, as well as in the listed circumstances. One circumstance is service providers: WHOOP may share your information with third parties to help it provide the Messaging Service to you.

Supporting quotations

We may share, transfer, or disclose your information, if you consent to us doing so, as well as in the following circumstances:

Service Providers. We may share your information with third parties to help us provide the Messaging Service to you.

Qualifications & exceptions

• The permission is framed as 'may' and is limited to helping provide the Messaging Service.

Not stated here

• Who the service providers are, and what limits apply to their use of the information, is not stated.

Sharing & Disclosure · Permission or license

WHOOP may disclose messaging information to comply with law, answer authorities or protect rights

WHOOP says it may disclose your information where it believes disclosure is necessary or appropriate to: (i) comply with applicable law and legal processes; (ii) respond to requests from public and government authorities, including authorities outside your country of residence; (iii) enforce a contract with it; (iv) protect its rights, privacy, safety or property, or that of its affiliates, you or others; and (v) allow it to pursue available remedies or limit damages it may sustain.

Supporting quotations

Legal Requirement and Protection of Iterable and Others. We may disclose your information as we believe such disclosure is necessary or appropriate to: (i) comply with applicable law and legal processes; (ii) respond to requests from public and government authorities, including public and government authorities outside your country of residence; (iii) enforce a contract with us; (iv) protect our rights, privacy, safety, or property, and/or that of our affiliates, you or others; and (v) allow us to pursue available remedies or limit the damages that we may sustain.

Qualifications & exceptions

• The test is WHOOP's own belief that disclosure is necessary or appropriate.
• Authorities outside your country of residence are expressly included.

Not stated here

• The label for this item refers to protection of 'Iterable and Others' while the text speaks of 'our' rights; the passage does not explain whose rights beyond those listed it covers.
• This policy covers the Messaging Service; the Privacy Principles earlier on the page describe a stricter stance toward requests from authorities, and the passage here does not address how the two fit together.

Sharing & Disclosure · Permission or license

Aggregated or de-identified messaging information may go to any third party, including advertisers

WHOOP says that from time to time it may share aggregate or de-identified information about use of the Messaging Service, and that this aggregated or de-identified information may be shared with any third party, including advertisers, promotional partners and sponsors.

Supporting quotations

From time to time, we may share aggregate or de-identified information about use of the Messaging Service and such aggregated or de-identified information may be shared with any third party, including advertisers, promotional partners, and sponsors.

Qualifications & exceptions

• This applies to aggregate or de-identified information about use of the Messaging Service, not to identifiable information.

Not stated here

• The passage does not describe how the information is aggregated or de-identified, or limit what recipients may do with it.

Security & Safeguards · Company practice

WHOOP says it uses physical, technical, administrative and organizational security measures

WHOOP says it takes a variety of physical, technical, administrative and organizational security measures, based on the sensitivity of the information it collects, to protect your information against accidental or unlawful destruction, accidental loss, alteration, and unauthorized disclosure or access.

Supporting quotations

We take a variety of physical, technical, administrative, and organizational security measures based on the sensitivity of the information we collect to protect your information against accidental or unlawful destruction or accidental loss, alteration, unauthorized disclosure or access.

Qualifications & exceptions

• The level of measures is tied to the sensitivity of the information collected.

Not stated here

• The measures themselves are not described.

Security & Safeguards · Restriction or exception

WHOOP does not guarantee security and does not accept liability for unintentional disclosure

WHOOP says no online activity can be guaranteed to be 100% secure and that, although it strives to protect your information against unauthorized use or disclosure, it cannot ensure or warrant the security of any information you provide. It also states that it does not accept liability for unintentional disclosure.

Supporting quotations

Unfortunately, no online activity can be guaranteed to be 100% secure. While we strive to protect your information against unauthorized use or disclosure, we cannot ensure or warrant the security of any information you provide. We do not accept liability for unintentional disclosure.

Qualifications & exceptions

• The liability statement is about unintentional disclosure; the passage does not address other kinds of disclosure.

Not stated here

• How far this disclaimer is enforceable is a legal question outside what the document says.

Retention & Deletion · Company practice

WHOOP keeps messaging information while you participate, as law requires, and as needed for disputes

WHOOP says it retains your information for as long as you participate in the Messaging Service or as needed to comply with applicable legal obligations. It also says it will retain and use your information as necessary to resolve disputes, protect itself and its customers, and enforce its agreements.

Supporting quotations

We retain your information for as long as you participate in the Messaging Service or as needed to comply with applicable legal obligations. We will also retain and use your information as necessary to resolve disputes, protect us and our customers, and enforce our agreements.

Qualifications & exceptions

• Retention can continue beyond your participation for legal obligations, disputes, protection and enforcement.

Not stated here

• No fixed retention period is given.

Account & Service Control · User right or choice

Reply STOP, END, CANCEL, UNSUBSCRIBE or QUIT to opt out of further texts

You can opt out of receiving further commercial or transactional text messages through the Messaging Service by replying to any of WHOOP's text messages with STOP, END, CANCEL, UNSUBSCRIBE or QUIT. For additional opt-out information, the policy refers you to WHOOP's Terms.

Supporting quotations

You can opt-out of receiving further commercial or transactional text messages via the Messaging Service by responding to any of our text messages with any of the following replies: STOP, END, CANCEL, UNSUBSCRIBE, or QUIT.

For additional opt-out information, please review our

Qualifications & exceptions

• The opt-out covers both commercial and transactional text messages.

Not stated here

• The Terms referred to for additional opt-out information are a separate linked document and are not part of this analysis.

Account & Service Control · Company commitment

Consent to automated marketing texts is not a condition of any purchase

WHOOP says consent to receive automated marketing text messages is not a condition of any purchase.

Supporting quotations

Consent to receive automated marketing text messages is not a condition of any purchase.

Qualifications & exceptions

• The statement is about automated marketing text messages.

Legal Rights & Agreement Rules · Restriction or exception

Signing up for WHOOP texts also means you agree to WHOOP's main Privacy Policy

WHOOP says that by signing up to receive text messages from it, you also agree to its main Privacy Policy.

Supporting quotations

By signing up to receive text messages from us, you also agree to our main

Qualifications & exceptions

• The agreement is triggered by signing up for the text messages.

Not stated here

• The sentence points to a linked 'main Privacy Policy' without saying which of WHOOP's privacy documents that is, and that document is not part of this analysis.

Use & Processing · Context

'Aggregated Data' is summarized data; aggregated across people, WHOOP treats it as no longer Personal Data

WHOOP defines Aggregated Data as data that has been gathered and expressed in summary form for statistical analysis, for example averages, minimums, maximums, sums and counts over a time period, across individuals, or both. It says that when data is aggregated across a number of individuals, the result is considered anonymized so that it is no longer Personal Data.

Supporting quotations

Aggregated Data is data that has undergone a process whereby raw data is gathered and expressed in a summary form for statistical analysis.

When data is aggregated across a number of individuals, the resulting aggregation is considered anonymized such that it is no longer Personal Data.

Qualifications & exceptions

• The 'no longer Personal Data' result is stated for data aggregated across a number of individuals; aggregation over time alone is not given that result in this definition.
• The definition is WHOOP's own, and the Privacy Principles and Messaging policy rely on aggregated or de-identified information.

Not stated here

• The definition does not say how many individuals must be included, or what safeguards apply, for aggregated data to be treated as anonymized.

Legal Rights & Agreement Rules · Context

The CCPA definition names California rights and quotes the law's broad meaning of 'sale'

WHOOP describes the California Consumer Privacy Act as a state law giving California consumers data privacy rights, including the right to know, the right to delete, and the right to opt out of 'sale' of personal information, as well as additional protections for minors. It quotes the CCPA's definition of a 'sale' as selling, renting, releasing, disclosing, disseminating, making available, transferring or otherwise communicating a consumer's personal information by the business to another business or a third party for monetary or other valuable consideration.

Supporting quotations

The California Consumer Privacy Act, or CCPA, is a state law that provides California consumers with robust data privacy rights. These rights include the right to know, the right to delete, and the right to opt-out of “sale” of personal information that businesses collect, as well as additional protections for minors.

A “sale” under the CCPA is defined as “selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer’s personal information by the business to another business or to a third party for monetary or other valuable consideration.”

Qualifications & exceptions

• The quoted definition of 'sale' reaches transfers for 'monetary or other valuable consideration', not only payments of money.
• WHOOP points to its Privacy Policy for more details on the information it may share with others.

Not stated here

• WHOOP's own reading of how the CCPA definition applies to its practices is not stated in this definitions entry; the Privacy Principles say only that, because of the definition's breadth, WHOOP discloses its use of third-party cookies and tracking.

Data Access & Collection · Context

'Cookies' are small files that let a site tailor pages and carry information between visits

WHOOP defines cookies as small files stored on a user's computer, designed to hold a modest amount of data specific to a particular user and website. They can be accessed by the web server or the user's computer, which lets the server deliver a page tailored to that user or lets the page carry information from one visit to the next.

Supporting quotations

Cookies are small files which are stored on a user’s computer. They are designed to hold a modest amount of data specific to a particular user and website, and can be accessed either by the web server or the user computer.

Not stated here

• The definition does not say which cookies WHOOP uses or for what purposes; the Privacy Policy is referred to for that.

Use & Processing · Context

'De-Identified Data' has personal identifiers removed and is treated as no longer Personal Data

WHOOP defines De-Identified Data as data from which all personally identifiable information has been removed, rendering it anonymous by stripping out information that would allow an individual's identity to be determined from the remaining data. It says De-Identified Data is no longer Personal Data.

Supporting quotations

De-Identified Data is data where all the personally identifiable information has been removed, rendering the data anonymous by stripping out information that would allow an individual’s identity to be determined from the remaining data.

De-identified Data is no longer Personal Data.

Qualifications & exceptions

• The definition is WHOOP's own; the Privacy Principles and Messaging policy rely on aggregated or de-identified information.

Not stated here

• The definition does not describe the method used or any protection against re-identification.

Legal Rights & Agreement Rules · Context

The GDPR definition covers European residents; details are in the full Privacy Policy

WHOOP describes the GDPR as a European data privacy and security regulation that sets guidelines for collecting and processing personal information of individuals who live in the European Economic Area, Switzerland and the United Kingdom, which it collectively calls 'Europe'. It says the GDPR gives European residents data protection rights and applies to any organization that offers goods or services to individuals in Europe, even if not based there.

Supporting quotations

The General Data Protection Regulation, or GDPR, is a data privacy and security regulation under European law that sets guidelines for the collection and processing of personal information from individuals who live in the European Economic Area, Switzerland and United Kingdom (collectively, “Europe” or “European”).

The GDPR provides data protection rights to European residents and applies to any organization that offers goods or services to individuals in Europe, even if that organization is not based in Europe.

Qualifications & exceptions

• The entry is a description of the regulation, not a statement of the specific rights WHOOP provides.

Not stated here

• The rights available to European residents are said to be in the Privacy Policy, which is a linked document not part of this analysis.

Data Access & Collection · Context

An IP address may be Personal Data and advertisers sometimes use it to serve interest-based ads

WHOOP defines an IP address as a unique address that identifies a device on the internet or a local network. It says an IP address may be considered Personal Data and is at times used by advertisers to serve interest-based ads.

Supporting quotations

An IP Address may be considered Personal Data and is at times used by advertisers to serve interest-based ads.

An IP Address is a unique address that identifies a device on the internet or a local network.

Qualifications & exceptions

• 'May be considered' and 'at times' keep both statements general; they do not say WHOOP shares IP addresses with advertisers.

Not stated here

• The entry does not say whether WHOOP itself provides IP addresses to advertisers; it points to the Privacy Policy for how Personal Data is shared.

Data Access & Collection · Context

'Personal Data' is any data that identifies or relates to you, including legal 'personal information'

WHOOP defines Personal Data as any data that identifies or relates to you as a particular individual, including information referred to as 'personally identifiable information' or 'personal information' under applicable data privacy laws, rules or regulations.

Supporting quotations

Personal Data is any data that identifies or relates to you as a particular individual, including information referred to as “personally identifiable information” or “personal information” under applicable data privacy laws, rules, or regulations.

Qualifications & exceptions

• The definition follows the terms used in applicable privacy laws.

Legal Rights & Agreement Rules · Context

'Services' means WHOOP's websites, mobile apps, strap software and related features

WHOOP defines Services collectively as its websites and mobile apps, any software embedded within the WHOOP Strap, and any features, content or applications that WHOOP offers from time to time in connection with them.

Supporting quotations

Services means, collectively, our websites and mobile apps, any software embedded within the WHOOP Strap, and any features, content, or applications offered, from time to time, by WHOOP in connection therewith.

Qualifications & exceptions

• The definition reaches features, content and applications offered 'from time to time', so it covers later additions.

Sharing & Disclosure · Context

'Third Parties' include service providers WHOOP relies on and advertisers serving interest-based ads

WHOOP defines Third Parties as entities or businesses involved in an arrangement, contract, deal or transaction who are not one of the principals, meaning WHOOP or WHOOP Members. It says it uses Third Parties to do business with members, such as charging for transactions or storing data, and that Third Parties also include advertisers that serve interest-based ads to visitors to its website.

Supporting quotations

Third Parties in the context of the relationship between WHOOP, WHOOP Members (our end users), and third parties are entities or businesses involved in an arrangement, contract, deal, or transaction but are not one of the principals (i.e., WHOOP or WHOOP Members).

We use Third Parties to enable us to do business with our members, such as charging for transactions or storing data. Third Parties also include advertisers that serve interest-based ads to visitors to our website.

Qualifications & exceptions

• Advertisers serving interest-based ads to website visitors are included in the definition of Third Parties.

Not stated here

• Which specific Third Parties receive which data is left to the Privacy Policy, which is a linked document not part of this analysis.

Data Access & Collection · Context

The WHOOP Strap is a wearable sensor that collects Personal Data when used with the Services

WHOOP describes the WHOOP Strap as a wearable sensor that, when used in connection with the Services, collects certain types of Personal Data.

Supporting quotations

Your WHOOP Strap is a wearable sensor that, when used in connection with the Services, collects certain types of Personal Data.

Qualifications & exceptions

• The collection is described as happening when the strap is used in connection with the Services.

Not stated here

• The entry does not list the types of Personal Data the strap collects; the Wellness Data definition lists some.

Legal Rights & Agreement Rules · Context

'WHOOP,' 'we,' 'us' and 'our' mean Whoop, Inc. and its wholly owned subsidiaries

WHOOP defines the terms 'WHOOP,' 'we,' 'us' and 'our' to mean Whoop, Inc. and each of its wholly owned subsidiaries.

Supporting quotations

The terms “WHOOP,” “we,” “us,” or “our” mean Whoop, Inc. and each of its wholly owned subsidiaries.

WHOOP, WE, US, OUR

Qualifications & exceptions

• The definition covers wholly owned subsidiaries; companies that are not wholly owned are not mentioned.

Data Access & Collection · Context

'Wellness Data' covers strap data plus anything you enter, including data linked from other accounts and devices

WHOOP defines Wellness Data as two groups: (a) data collected by your WHOOP Strap and sent to the WHOOP platform, including heart rate, heart rate variability, sleep duration, respiratory rate, skin temperature, blood oxygen saturation level, and data such as the type of activity you engage in and its duration; and (b) any additional information you choose to enter while using the Services, such as information about your health and wellness, including information collected from accounts, devices or features that you link with your WHOOP account. 'Services' means WHOOP's websites and mobile apps, software embedded in the WHOOP Strap, and related features, content and applications.

Supporting quotations

Wellness Data is (a) data collected by your WHOOP Strap and sent to the WHOOP platform, including your heart rate, heart rate variability, sleep duration, respiratory rate, skin temperature, blood oxygen saturation level, and data such as the type of activity you engage in and the duration of your physical activity; and (b) any additional information you chose to enter during the use of our Services, such as information about your health and wellness, including information collected from accounts, devices, or features that you link with your WHOOP account.

Services means, collectively, our websites and mobile apps, any software embedded within the WHOOP Strap, and any features, content, or applications offered, from time to time, by WHOOP in connection therewith.

Qualifications & exceptions

• Group (b) expressly includes information collected from accounts, devices or features you link with your WHOOP account.
• This definition is longer than the list given in the Privacy Principles, which does not mention linked accounts and devices.

Not stated here

• The definition refers to the Privacy Policy for additional details on Wellness Data; that policy is a linked document not part of this analysis.

Security & Safeguards · Context

The Security section is for researchers; members with account security issues should contact Membership Services

WHOOP says its security site provides information for researchers and security professionals, and that a WHOOP member experiencing a security issue with their account should contact Membership Services instead. The section opens by saying that WHOOP manages personal and sensitive data of its members like other companies providing wearable devices and health monitoring services, that it takes privacy seriously, and that it has a responsibility to protect the privacy of members' data.

Supporting quotations

If you are a WHOOP member and are experiencing a security issue with your account please contact

This site provides information for researchers and security professionals.

Like all companies providing wearable devices and health monitoring services, WHOOP manages personal and sensitive data of our members. We take privacy seriously, and understand that we have a responsibility to protect the privacy of our members’ data.

Qualifications & exceptions

• The member route (Membership Services) is separate from the researcher route for vulnerability reports.

Not stated here

• The introduction states values and responsibilities in general terms; it does not describe specific security controls.

Security & Safeguards · Procedure

WHOOP accepts vulnerability reports and sends back a tracking identifier

WHOOP says it openly accepts vulnerability reports for its WHOOP platform and products. If you believe you have found a vulnerability, or have a security incident to report, you are asked to contact WHOOP through its vulnerability disclosure form, and on receipt WHOOP says it will reply with a tracking identifier. The link at the end of the section, labelled Submit, points to a HackerOne page named whoop_bug_bounty.

Supporting quotations

WHOOP openly accepts vulnerability reports for our WHOOP platform and products. If you believe you have discovered a vulnerability in a WHOOP platform or product, or if you have a security incident to report, please contact us our vulnerability disclosure form below. Upon receipt of your message, we will send a reply that includes a tracking identifier.

Submit

Qualifications & exceptions

• The form is described as 'below' the text; the Submit link is at the end of the Security section.

Not stated here

• The passage does not say how long WHOOP takes to respond beyond the tracking identifier reply, or what it does with reports.

Legal Rights & Agreement Rules · Company commitment

WHOOP will not take legal action against good-faith vulnerability reporters who use its listed methods

WHOOP says it will not engage in legal action against individuals who in good faith submit vulnerability reports through the methods listed in the section.

Supporting quotations

WHOOP will not engage in legal action against individuals who in good faith submit vulnerability reports through the methods listed above.

Qualifications & exceptions

• The commitment depends on two conditions: the report is submitted in good faith, and it goes through the methods listed.
• The text says 'listed above' while the disclosure form is described as 'below', so the exact set of listed methods is not entirely clear.

Not stated here

• The commitment does not define 'good faith' or say what happens to someone who discloses a vulnerability by other routes.

Security & Safeguards · Company practice

WHOOP's disclosure policy uses a 90-day deadline that can move for weekends, pending patches or extreme circumstances

WHOOP says vulnerability disclosure is a two-way street and that it adheres to a 90-day disclosure deadline. It says it notifies vendors of vulnerabilities immediately, with details shared publicly with the defensive community after the Deadline, or sooner if the vendor releases a fix. The Deadline can vary: if it would expire on a weekend or U.S. public holiday it moves to the next regular work day; if a vendor says before the Deadline expires that a patch is scheduled within 14 days after the Deadline, WHOOP will delay public disclosure until the patch is available; and WHOOP reserves the right to bring the Deadline forward or backward based on extreme circumstances. It says it treats all vendors strictly equally and expects to be held to the same standard.

Supporting quotations

WHOOP adheres to a 90-day disclosure deadline (the “Deadline”). We notify vendors of vulnerabilities immediately, with details shared in public with the defensive community after the Deadline, or sooner if the vendor releases a fix. That Deadline can vary in the following ways:

If a Deadline is due to expire on a weekend or U.S. public holiday, the Deadline will be moved to the next regular work day.

Before the Deadline has expired, if a vendor lets us know that a patch is scheduled for release on a specific day that will fall within 14 days following the Deadline, we will delay the public disclosure until the availability of the patch.

As always, we reserve the right to bring the Deadline forward or backward based on extreme circumstances. We remain committed to treating all vendors strictly equally. WHOOP expects to be held to the same standard.

Qualifications & exceptions

• The 14-day patch extension depends on the vendor telling WHOOP before the Deadline expires that a patch is scheduled for a specific day.
• The reservation to move the Deadline is for 'extreme circumstances'.
• Actively exploited, previously unknown vulnerabilities follow a shorter timeline (see the 7-day card).

Not stated here

• The text is written about WHOOP notifying vendors of vulnerabilities and sharing details publicly; it does not spell out whether, and how, the same deadline applies to vulnerabilities reported to WHOOP about its own products.

Security & Safeguards · Company practice

For actively exploited unknown vulnerabilities, WHOOP uses a 7-day timeline before supporting disclosure

When WHOOP observes a previously unknown and unpatched vulnerability in software that is under active exploitation (a '0day'), it says more urgent action, within 7 days, is appropriate. It gives the reason that each day an actively exploited vulnerability stays undisclosed and unpatched, more devices or accounts are compromised. After 7 days without a patch or advisory, WHOOP says it will support researchers making details available so users can take steps to protect themselves. WHOOP acknowledges that seven days is aggressive and may be too short for some vendors to update their products.

Supporting quotations

When we observe a previously unknown and unpatched vulnerability in software under active exploitation (a “0day”), we believe that more urgent action - within 7 days - is appropriate.

after 7 days have elapsed without a patch or advisory, we will support researchers making details available so that users can take steps to protect themselves.

Qualifications & exceptions

• The 7-day timeline applies to previously unknown, unpatched vulnerabilities in software under active exploitation that WHOOP observes.
• WHOOP says the time should be enough to publish advice on mitigations such as temporarily disabling a service, restricting access or contacting the vendor.

Not stated here

• The text does not say whether the 7-day path is used for vulnerabilities in WHOOP's own products.

Sharing & Disclosure · Company commitment

CCPA section: WHOOP does not sell personal information; it and partners use cookies for advertising

In its CCPA section WHOOP says it takes the privacy of its Members and Customers seriously and does not sell personal information. It also says its Services provide, and its partners use, automated technologies such as cookies to understand how people use its products and Services and to support advertising, and that you can learn how to limit these technologies in its Privacy Policy. 'Services' means WHOOP's websites, mobile apps, software embedded in the WHOOP Strap and related features.

Supporting quotations

At WHOOP, we take the privacy of our Members and Customers seriously. We do not sell personal information.

Our Services provide and our partners use automated technologies, such as cookies, to understand how people use our products and Services and to support advertising.

Services means, collectively, our websites and mobile apps, any software embedded within the WHOOP Strap, and any features, content, or applications offered, from time to time, by WHOOP in connection therewith.

Qualifications & exceptions

• The no-sale statement and the advertising-technology statement appear together; the section does not say whether WHOOP treats the advertising-related data flows as a 'sale'.

Not stated here

• How to limit these technologies is left to the full Privacy Policy, which is not part of this analysis.
• The section does not name the partners or say what data the cookies collect.

Account & Service Control · User right or choice

California residents have CCPA rights to know, access, delete and stop sale, with CCPA limits

WHOOP says the CCPA gives residents of California four rights: to know how personal information is collected and used, to have access to and request the personal information collected, to have personal data deleted, and to stop personal information from being sold or shared. It adds that the CCPA limits these rights, for example by prohibiting businesses from providing certain sensitive information in response to an access request and by limiting the circumstances in which they must comply with a deletion request.

Supporting quotations

The CCPA also provides the following rights if you are a resident of the state of California: (1) the right to know how your personal information is collected and used; (2) the right to have access to and request the personal information collected; (3) the right to have your personal data deleted; and (4) 4he right to stop your personal information from being sold or shared.

The CCPA limits these rights by, for example, prohibiting businesses from providing certain sensitive information in response to an access request and limiting the circumstances in which they must comply with a deletion request.

A “sale” under the CCPA is defined as “selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer’s personal information by the business to another business or to a third party for monetary or other valuable consideration.”

Qualifications & exceptions

• The rights are stated for residents of California; the sentence describes what the CCPA provides rather than a separate WHOOP promise.
• Access can be limited for certain sensitive information, and deletion requests need to be honored only in limited circumstances.

Not stated here

• The section does not say which categories of sensitive information are withheld or which circumstances excuse a deletion request.
• The Privacy Principles earlier on the page say WHOOP will delete personal data if asked without stating these limits.

Account & Service Control · Procedure

Send privacy rights requests or questions to privacy@whoop.com or the data management page

For privacy rights requests or questions about your privacy rights, WHOOP asks you to email privacy@whoop.com, and it provides a link for more on data management.

Supporting quotations

For privacy rights requests or questions about your privacy rights, please email us at

Not stated here

• The section does not set a response time or describe verification.

Content & IP Rights · Context

WHOOP lists US patents it says cover the WHOOP 4.0, the WHOOP 4.0 and app, and the WHOOP Body

WHOOP says the products listed are covered by at least the indicated US patents, and that additional US patent applications and non-US patents may cover them. For the WHOOP 4.0 it lists 11,410,765, 11,185,241, 10,750,958, 11,185,292, D977115 and D973584. For the WHOOP 4.0 and the WHOOP App it lists 11,602,279, 11,627,946 and 9,596,997. For the WHOOP Body it lists D977116.

Supporting quotations

The WHOOP® products listed below are covered by at least the indicated US patents. Additional US patent applications and non-US patents may cover these products.

WHOOP 4.0

11,410,765

11,185,241

10,750,958

11,185,292

D977115

D973584

WHOOP 4.0 & WHOOP App

11,602,279

11,627,946

9,596,997

WHOOP Body

D977116

Qualifications & exceptions

• The list is a minimum ('at least'): additional US patent applications and non-US patents may also cover these products.

Not stated here

• The list gives patent numbers only; it does not say what each patent covers.

Charges & Financial Obligations · Context

The Minimum Advertised Price Policy is WHOOP's rule for US Resellers, not for customers

WHOOP says it has unilaterally established this Minimum Advertised Price Policy (MAP Policy) for certain WHOOP Products sold by Resellers in the United States. 'Resellers' means WHOOP's network of resellers, distributors, sales representatives or dealers. WHOOP says its purposes include protecting Resellers' investments in the customer experience and discouraging price-based advertising that would be detrimental to Resellers' service and support efforts.

Supporting quotations

WHOOP also recognizes that our success is tied to the success of our network of resellers, distributors, sales representatives or dealers (collectively, “Resellers”).

Therefore, WHOOP has unilaterally established this Minimum Advertised Price Policy (“MAP Policy”) for certain WHOOP Products sold by Resellers in the United States.

We want to protect our Resellers investments in delivering an extraordinary customer experience, while also discouraging price-based advertising that would be detrimental to our Resellers’ service and support efforts.

Qualifications & exceptions

• The policy applies to certain WHOOP Products, as listed in Schedule A, sold by Resellers in the United States.
• The policy is addressed to Resellers; it is not a term of a customer's purchase from WHOOP.

Not stated here

• The policy does not say whether it applies outside the United States or to products not listed in Schedule A.

Charges & Financial Obligations · Restriction or exception

Resellers may not advertise below the Schedule A price, which WHOOP can change at its sole discretion

The Minimum Advertised Price for each WHOOP Product must be no less than the price set in Schedule A, and WHOOP may adjust it at such time and in such amounts as it determines in its sole discretion. The policy sets no maximum advertised price: Resellers may offer WHOOP Products at any price above the Minimum Advertised Price.

Supporting quotations

The Minimum Advertised Price for each WHOOP Product shall be no less than the minimum advertised price as set forth on Schedule A (the “Minimum Advertised Price”). This Minimum Advertised Price established by WHOOP may be adjusted by WHOOP at such time and in such amounts as it may determine at its sole discretion.

This MAP Policy does not establish maximum advertised prices. Resellers may offer WHOOP Products at any price in excess of the Minimum Advertised Price.

Qualifications & exceptions

• This is a limit on advertised price, as the policy states; it does not set what a Reseller may charge above that price.

Charges & Financial Obligations · Restriction or exception

Resellers need WHOOP's written consent to list products on third-party sites such as Amazon or eBay

A Reseller must not list WHOOP Products on any third-party website, including Amazon, eBay and Overstock, without first obtaining written consent from WHOOP. A Reseller may sell WHOOP Products on its own website associated directly with its store or stores, as long as it follows the MAP Policy.

Supporting quotations

A Reseller shall not list WHOOP Products on any third-party website (including without limitation Amazon, eBay, Overstock, etc.), without first obtaining written consent from WHOOP. A Reseller may sell WHOOP Products on its own website associated directly with its store(s) so long as the Reseller adheres to this MAP Policy.

Qualifications & exceptions

• The named sites are examples ('including without limitation').
• Selling on a Reseller's own store-linked website is allowed only if the Reseller adheres to the MAP Policy.

Charges & Financial Obligations · Restriction or exception

The policy covers advertising in almost any medium, except in-store advertising shown only in the store

The MAP Policy applies to all advertisements of WHOOP Products in any and all media, including email newsletters and solicitations, internet or other electronic media, television, radio, public signage, posters, flyers, coupons, mailers, inserts, newspapers, magazines, catalogs and mail order catalogs. It does not apply to in-store advertising that is displayed only in the store and not distributed to customers.

Supporting quotations

This MAP Policy applies to all advertisements of WHOOP Products in any and all media, including without limitation email newsletters, email solicitations, internet or other electronic media, television, radio, public signage, posters, flyers, coupons, mailers, inserts, newspapers, magazines, catalogs, or mail order catalogs. This MAP policy is not applicable to any in-store advertising that is displayed only in the store and not distributed to any customers.

Qualifications & exceptions

• The in-store exception covers only advertising displayed in the store and not distributed to any customers.

Charges & Financial Obligations · Restriction or exception

No strike-through prices, and no free or discounted add-ons that effectively cut the advertised price below the minimum

If pricing is displayed anywhere other than a brick-and-mortar retail store, any strike-through or other alteration of the Minimum Advertised Price is prohibited. Including free or discounted products in advertising with a covered WHOOP Product is contrary to the policy if it has the effect of discounting the advertised price of the covered product below the Minimum Advertised Price. A Reseller may still advertise in general that it has 'the lowest prices' or will 'match or beat a competitors' price' or similar phrases, as long as the price advertised or listed is not below the Minimum Advertised Price and the Reseller otherwise complies.

Supporting quotations

If pricing is displayed anywhere other than a brick-and-mortar-retail store, any strike-through or other alteration of the Minimum Advertised Price is prohibited.

Including free or discounted products in advertising with any WHOOP Product covered by this MAP Policy is contrary to this MAP Policy if it has the effect of discounting the advertised price of the covered WHOOP Product below the Minimum Advertised Price.

The MAP policy does not limit a Reseller’s ability to advertise in general that they have “the lowest prices” or will “match or beat a competitors’ price” or phrases of similar meaning as long as the price advertised or listed for the WHOOP Product is not less than the Minimum Advertised Price and the Reseller otherwise complies with this MAP Policy.

Qualifications & exceptions

• The strike-through prohibition applies when pricing is shown anywhere other than a brick-and-mortar retail store.
• The free-or-discounted-product rule depends on the effect of lowering the advertised price of the covered product below the minimum.
• General 'lowest price' or price-match phrases are allowed only while the advertised or listed price stays at or above the minimum.

Charges & Financial Obligations · Permission or license

WHOOP can run a temporary sale, and the minimum then equals the sale price for that period

WHOOP keeps the right, at its sole discretion, to run a temporary sale on any WHOOP Product. During such a sale, the Minimum Advertised Price for that product is the same as the temporary sale price for the applicable time period.

Supporting quotations

WHOOP maintains the right to run a temporary sale on any WHOOP Product at its sole discretion. In the case of any such sale, the Minimum Advertised Price for the applicable WHOOP Product will be the same as the temporary sale price for the applicable time period.

Qualifications & exceptions

• The price change is limited to the applicable time period of the sale.

Not stated here

• The policy does not say how Resellers are told of a temporary sale.

Cross-references

• narrows (model-proposed): Resellers may not advertise below the Schedule A price, which WHOOP can change at its sole discretion — narrows: During a WHOOP temporary sale the Minimum Advertised Price for the product equals the sale price for that period, which changes the Schedule A floor for that time.

Charges & Financial Obligations · Company practice

WHOOP may monitor advertised prices, and a violation at one store or site counts against the whole Reseller

WHOOP may monitor Resellers' advertised prices, either directly or through third-party agencies or tools. If a Reseller with multiple store locations violates the policy at any single store location or on any associated website, WHOOP will consider it a violation by the Reseller.

Supporting quotations

WHOOP may monitor the advertised prices of Resellers, either directly or via the use of third party agencies or tools.

If a Reseller with multiple store locations violates this MAP Policy at any single store location, or on any associated website, then WHOOP will consider this to be a violation of this MAP Policy by the Reseller.

Qualifications & exceptions

• Monitoring is described as something WHOOP 'may' do.

Legal Rights & Agreement Rules · Restriction or exception

WHOOP alone decides violations and sanctions, and may enforce without notice, up to ending the reseller agreement

WHOOP says it is solely responsible for deciding whether a violation of the MAP Policy has occurred and what sanctions are appropriate, and that WHOOP marketing or sales personnel are not authorized to negotiate, amend, modify, waive or grant exceptions to the policy. WHOOP will enforce the policy in its sole discretion and without notice. A Reseller has no right to enforce the policy. In addition to any remedies available at law, violations may result in notification of a violation, cancellation of pending Reseller orders, restrictions on future orders, suspension of a Reseller's account, or termination of any agreement with the Reseller.

Supporting quotations

WHOOP is solely responsible for determining whether a violation of the MAP Policy has occurred and determining appropriate sanctions. WHOOP marketing or sales personnel are not authorized to negotiate, amend, modify, waive or grant exceptions to the MAP Policy.

WHOOP will enforce this MAP Policy in its sole discretion and without notice. A Reseller has no right to enforce the MAP Policy. In addition to any available remedies WHOOP may have at law, violations of this MAP Policy may result in sanctions such as notification of a violation, cancellation of pending Reseller orders, restrictions on future Reseller orders, suspension of a Reseller’s account, cancellation of pending Reseller orders, or termination of any agreement with the Reseller.

Qualifications & exceptions

• Sanctions are listed as things that 'may' result, in addition to any remedies WHOOP may have at law.
• Enforcement may happen without notice to the Reseller.

Not stated here

• The policy does not describe any appeal or dispute process for a Reseller.

Charges & Financial Obligations · Context

Schedule A sets minimum advertised prices for the 12-month subscription, two bands and the battery pack

Schedule A lists these Minimum Advertised Prices: $239.00 for the 12-month upfront subscription (which includes the WHOOP 4.0, device, battery and strap); $49.00 for the SuperKnit Band; $99.00 for the SuperKnit Luxe Band; and $49.00 for the Battery Pack 4.0.

Supporting quotations

SCHEDULE A TO MAP POLICY

12-month upfront subscription (includes WHOOP 4.0, device, battery, and strap). Minimum Advertised Price is $239.00.

SuperKnit Band. Minimum Advertised Price is $49.00

SuperKnit Luxe Band. Minimum Advertised Price is $99.00

Battery Pack 4.0. Minimum Advertised Price $49.00

Qualifications & exceptions

• WHOOP may adjust these prices at its sole discretion, and a temporary sale resets the minimum to the sale price for that period.

Data Access & Collection · Context

The Consumer Health Data Privacy Notice covers consumer health data across WHOOP's Services, including Advanced Labs

This Notice, last updated August 3, 2026, describes how Whoop, Inc. collects, uses and protects consumer health data about WHOOP members and other consumers who interact with WHOOP or use its services. That includes visiting its websites or social media pages, or using its mobile apps, the WHOOP Strap, another WHOOP device, or any features, content or applications, such as Advanced Labs, that WHOOP offers in connection with them. The Notice also outlines how this information may be shared with or used by third-party laboratory or clinical services when applicable, and the privacy rights and choices you have.

Supporting quotations

Last Updated: August 3, 2026

This Consumer Health Data Privacy Notice (“Notice”) describes how Whoop, Inc. (“WHOOP,” “we,” “our,” or “us”) collects, uses, and protects consumer health data about WHOOP members and other consumers who interact with WHOOP or use our services, including by visiting our websites or our social media pages or by using our mobile apps, the WHOOP Strap, another WHOOP device, or any features, content, or applications, such as Advanced Labs, offered by WHOOP in connection therewith (collectively, the “Services”). This Notice also outlines how such information may be shared with or used by third-party laboratory or clinical services, when applicable, and the privacy rights and choices you have with respect to such data.

Qualifications & exceptions

• The Notice defines its own 'Services', which is wider than the Definitions section of this page: it includes visiting WHOOP's social media pages, another WHOOP device, and features such as Advanced Labs.
• The Notice applies 'to the extent required by applicable US state laws'.

Not stated here

• Which states' laws trigger the Notice for a particular person is not stated in this section.

Legal Rights & Agreement Rules · Restriction or exception

This Notice supplements the Privacy Policy and controls if the two conflict

WHOOP says this Notice supplements the WHOOP Privacy Policy and applies to the extent required by applicable US state laws. If there is a conflict between the Privacy Policy and this Notice, the Notice controls.

Supporting quotations

This Notice supplements the WHOOP Privacy Policy and applies to the extent required by applicable US state laws. In the event of a conflict between our Privacy Policy and this Notice, this Notice controls.

Qualifications & exceptions

• The Notice controls in a conflict with the Privacy Policy; the Notice itself refers to a separate rule for processing on behalf of a HIPAA covered entity later in the document.

Not stated here

• The Privacy Policy is a linked document that is not part of this analysis, so which of its terms might conflict is not known here.

Data Access & Collection · Company practice

WHOOP may collect consumer health data about conditions, lifestyle, vital signs and measurements

Depending on your use of the Services, WHOOP may collect consumer health data that identifies your past or present physical or mental health status. The categories include: information about health conditions, treatments or diagnoses, such as health history, hereditary or chronic conditions, prescribed medications, substance use or related disorders and any other medical information you provide; social, psychological, behavioral and lifestyle interventions, such as exercise routines, training and recovery goals, dietary and sleep habits, stress management practices and other habit or wellness metrics you choose to share; and information about bodily functions, vital signs and physiological measurements, such as weight, height, heart rate and respiratory rate, collected directly through the Services or obtained from third parties such as Apple Health or other integrated apps and devices when you grant permission.

Supporting quotations

Depending on your use of the Services, we may collect certain consumer health data about you that identifies your past or present physical or mental health status.

Information about your health conditions, treatments, or diagnoses, including details about your health history, hereditary or chronic conditions, prescribed medications, substance use or related disorders, as well as any other medical information you provide.

Social, psychological, behavioral, and lifestyle interventions, including your exercise routines, training and recovery goals, dietary and sleep habits, stress management practices, and other habit or wellness metrics you choose to share with us.

Information about your bodily functions, vital signs, and physiological measurements, including your weight, height, heart rate, respiratory rate, and other information collected directly through our Services or obtained from third parties, such as Apple Health or other integrated apps and devices, when you grant permission.

Qualifications & exceptions

• Collection depends on your use of the Services.
• Information from third parties such as Apple Health is obtained when you grant permission.
• The lists use 'including' and 'other', so they are illustrative.

Use & Processing · Company practice

Blood and lab test results you provide are collected and combined with your other wellness data

WHOOP lists diagnostic testing and biomarkers, including blood test results and laboratory test results such as blood panels, biomarkers and diagnostic values, that you provide to WHOOP or that are shared with WHOOP when you use the Services. It says it will integrate and analyze these results with your other wellness data, such as sleep, training and recovery metrics, to generate personalized insights.

Supporting quotations

Diagnostic testing and biomarkers, including blood test results and laboratory test results (e.g., blood panels, biomarkers, diagnostic values) that you provide to us or that are shared with us when you use our Services. We will integrate and analyze these results with your other wellness data (such as sleep, training, and recovery metrics) to generate personalized insights.

Qualifications & exceptions

• Results are either provided by you or shared with WHOOP when you use the Services.

Not stated here

• The notice does not say how long lab results are kept beyond the general retention statement later in this Notice.

Inference & Profiling · Company practice

WHOOP also creates derived or inferred health information, such as risk scores and readiness estimates

WHOOP lists derived or inferred health information among the consumer health data it handles. This is insights it generates from your provided data, such as biomarker-based health trends, estimated recovery readiness, risk scores or personalized recommendations to support changes to your habits and improve your performance and overall wellness.

Supporting quotations

Derived or inferred health information, including insights we generate from your provided data, such as biomarker-based health trends, estimated recovery readiness, risk scores, or personalized recommendations to support changes to your habits and improve your performance and overall wellness.

Qualifications & exceptions

• The examples are introduced by 'such as', so they are illustrative.

Data Access & Collection · Company practice

WHOOP gets consumer health data from you, from third-party apps you permit, and from labs you direct to share

WHOOP says it collects consumer health data from you, when you create an account, input information into its apps or devices, or upload health documentation such as blood test or lab results. It also collects from third parties when you grant permission, such as your Apple Health app or other apps or fitness trackers. It may receive consumer health data from third-party laboratories or clinical partners when you direct them to share results with it.

Supporting quotations

We collect consumer health data about you from:

When you create an account, input information into our apps or devices, or upload health documentation such as blood test results or lab results.

When you grant us permission to collect data from third parties, such as your Apple Health app or other apps or fitness trackers.

We may receive consumer health data from third-party laboratories and/or clinical partners when you direct them to share results with us.

Qualifications & exceptions

• Third-party sources depend on your permission or direction.

Use & Processing · Company practice

WHOOP uses consumer health data to provide the Services, connect you to third parties and enhance the experience

WHOOP says it collects and uses your consumer health data to provide the Services, connect you to third parties and enhance the WHOOP experience, including: personalizing insights and health feedback based on your lab values; integrating your test results into existing performance metrics and trends; research and development to improve its Services in a de-identified or aggregated form; and responding to requests from applicable regulatory authorities.

Supporting quotations

We collect and use your consumer health data in order to provide the Services, connect you to third parties and enhance the WHOOP experience, including:

Personalizing insights and health feedback based on your lab values;

Integrating your test results into existing performance metrics and trends;

Research and development to improve our Services, in a de-identified or aggregated form; and

Responding to requests from applicable regulatory authorities.

Qualifications & exceptions

• The research and development use is described as being in de-identified or aggregated form.
• The word 'including' signals the list is not exhaustive.

Not stated here

• 'Connect you to third parties' is not explained further in this section.

Sharing & Disclosure · Company commitment

WHOOP says it does not sell consumer health data; personalization stays inside WHOOP and is not used for third-party ads

WHOOP says it does not sell your consumer health data to third parties. It says any personalization based on your health data occurs within WHOOP and is not used for third-party advertising. Where required by applicable law, it says it will obtain your consent before using consumer health data for marketing or promotional purposes.

Supporting quotations

We do not sell your consumer health data to third parties.

Any personalization based on your health data occurs within WHOOP and is not used for third-party advertising. Where required by applicable law, we will obtain your consent before using consumer health data for marketing or promotional purposes.

Qualifications & exceptions

• The consent commitment applies 'where required by applicable law'.
• These statements concern consumer health data; the Notice separately lists categories of recipients in the Data Sharing section.

Not stated here

• The Notice does not say whether any use of consumer health data for WHOOP's own marketing occurs where consent is not required by law.

Use & Processing · User right or choice

You can switch off health-data personalization in Privacy Settings, which may affect some features

WHOOP says you can control how your health data is used to personalize your WHOOP experience in the WHOOP app by going to Privacy Settings. If you turn this setting off, WHOOP says it will no longer use your health data to personalize recommendations, offers or similar features within WHOOP, which may affect certain features of the Services.

Supporting quotations

You can control how your health data is used to personalize your WHOOP experience in the WHOOP app by going to Privacy Settings. If you turn this setting off, we will no longer use your health data to personalize recommendations, offers, or similar features within WHOOP, which may affect certain features of the Services.

Qualifications & exceptions

• Turning the setting off stops personalization of recommendations, offers and similar features; it is not described as deleting data or stopping other uses.

Not stated here

• The section does not say which features are affected or whether the setting stops the other uses described in this Notice.

Sharing & Disclosure · Permission or license

WHOOP may share consumer health data with service providers, including labs and clinical providers you direct it to use

WHOOP says it may share your consumer health data with service providers or processors it works with to provide the Services, including third-party laboratory and clinical service providers when you direct it to obtain or integrate your test results, biomarkers or other clinical data into its platform.

Supporting quotations

We may share your consumer health data with:

Service providers or processors we collaborate in order to provide the Services, including third-party laboratory and clinical service providers when you direct us to obtain or integrate your test results, biomarkers, or other clinical data into our platform;

Qualifications & exceptions

• Sharing with laboratory and clinical providers is described as happening when you direct it.

Not stated here

• The providers and processors are not named, and the section does not limit what they may do with the data.

Sharing & Disclosure · Permission or license

WHOOP may share consumer health data with authorities or other third parties on a good-faith belief it is necessary

WHOOP says it may share your consumer health data with law enforcement, government agencies or other third parties where it believes in good faith that doing so is necessary or appropriate to comply with applicable laws or protect its legitimate interests.

Supporting quotations

We may share your consumer health data with:

Law enforcement, government agencies or other third parties, where we believe in good faith it is necessary or appropriate to comply with applicable laws or protect our legitimate interests;

Qualifications & exceptions

• The test is WHOOP's good-faith belief that sharing is necessary or appropriate.
• Protecting 'legitimate interests' is a separate basis from complying with laws.

Not stated here

• The Privacy Principles earlier on the page describe WHOOP as never voluntarily disclosing member data in response to government or litigant requests and sharing copies only on a valid binding request; this Notice's wording is broader and the page does not explain how the two fit together.

Sharing & Disclosure · Permission or license

If WHOOP is sold or merged, your consumer health data may go to the new owner, with reasonable efforts to tell you first

WHOOP says it may share your consumer health data with business transferees in the event of a merger, sale, acquisition, bankruptcy or other transaction in which that third party assumes control of WHOOP's business or data, in whole or in part. If such an event occurs, WHOOP says it will make reasonable efforts to notify you before your consumer health data becomes subject to different privacy and security policies and practices.

Supporting quotations

Business transferees, in the event of a merger, sale, acquisition, bankruptcy or other transaction in which that third party assumes control of our business or data (in whole or in part). Should one of these events occur, we will make reasonable efforts to notify you before your consumer health data becomes subject to different privacy and security policies and practices; and

Qualifications & exceptions

• The notice commitment is to 'reasonable efforts', not a guarantee of advance notice.
• Control of data 'in whole or in part' is enough to trigger the provision.

Not stated here

• The notice does not say how you would be told or whether you could object.

Sharing & Disclosure · Permission or license

WHOOP may share consumer health data with other third parties with your consent or at your direction

WHOOP says it may share your consumer health data with other third parties with your consent or at your direction.

Supporting quotations

Other third parties, with your consent or at your direction.

Retention & Deletion · Company practice

WHOOP keeps consumer health data as long as necessary to provide the Services or as law requires

WHOOP says it retains your consumer health data for as long as necessary to provide its Services or as required by applicable law.

Supporting quotations

We retain your consumer health data for as long as necessary to provide our Services or as required by applicable law.

Qualifications & exceptions

• Retention follows what is necessary to provide the Services or what applicable law requires.

Not stated here

• No fixed retention period is given, and the notice does not say how deletion requests interact with the legal-requirement basis.

Account & Service Control · User right or choice

Depending on your state, you may withdraw consent to future collection, use or sharing of consumer health data

WHOOP says that, depending on your state of residence, you may have certain rights. One is the right to withdraw consent, to the extent WHOOP relies on your consent for collecting, using or sharing your consumer health data, from future collection, use or sharing.

Supporting quotations

Depending on your state residency, you may have certain rights to:

Withdraw consent. To the extent we rely upon your consent for our collection, use or sharing of your consumer health data, you have the right to withdraw such consent from future collection, use or sharing.

Qualifications & exceptions

• Which rights you have depends on your state residency.
• Withdrawal applies to the extent WHOOP relies on your consent and only to future collection, use or sharing.

Not stated here

• The notice does not say in which states each right applies.

Account & Service Control · User right or choice

You may confirm what WHOOP collected, shared or sold, access your data, and get a list of recipients

WHOOP lists an access and confirm right. You have the right to ask WHOOP to confirm whether it has collected, shared or sold your consumer health data, the right to access the consumer health data it has collected from or about you, and the right to access a list of all third parties it has shared your consumer health data with.

Supporting quotations

Access and confirm. You have the right to ask us to confirm whether we have collected, shared or sold your consumer health data. You have the right to access the consumer health data that we have collected from or about you. You also have a right to access a list of all third parties we have shared your consumer health data with.

Qualifications & exceptions

• This right, like the others, applies depending on your state residency.

Account & Service Control · User right or choice

You may ask WHOOP to correct inaccuracies in or delete your consumer health data

WHOOP lists a correction right, to ask it to correct inaccuracies in your consumer health data, and a deletion right, to ask it to delete your consumer health data.

Supporting quotations

Correction. You have the right to ask us to correct inaccuracies in your consumer health data.

Deletion. You have the right to ask us to delete your consumer health data.

Qualifications & exceptions

• These rights apply depending on your state residency.

Not stated here

• The notice does not state exceptions or timing for correction or deletion, and its retention section says data may be kept as required by applicable law.

Account & Service Control · User right or choice

If WHOOP denies a right you try to use, you may appeal and then complain to a regulator

WHOOP says you have the right to appeal its denial of a right you have attempted to exercise, and that it will provide details on how to appeal in connection with the denial. If your appeal is denied, you may issue a complaint to the appropriate regulatory enforcement authorities.

Supporting quotations

Appeal. You have the right to appeal our denying a right you have attempted to exercise. We will provide details on how to appeal our denial in connection with such action. If your appeal is denied, you may issue a complaint with appropriate regulatory enforcement authorities.

Qualifications & exceptions

• The appeal details are to be given when a right is denied; they are not set out in this Notice.

Not stated here

• The Notice does not describe the appeal process, deadlines or the regulators concerned.

Account & Service Control · Procedure

Request access, correction or deletion of consumer health data through Data Management or privacy@whoop.com

To request access to, or correction or deletion of, consumer health data collected through your use of the Services, WHOOP asks you to use the Data Management feature on the WHOOP Privacy Center at privacy.whoop.com, or to email privacy@whoop.com.

Supporting quotations

To request access to, or correction or deletion of consumer health data collected via your use of the Services, please either (i) use the “Data Management” feature available on the WHOOP Privacy Center at: privacy.whoop.com; or (ii) email us at privacy@whoop.com.

Not stated here

• Verification steps and response times are not described.

Account & Service Control · Company commitment

WHOOP says it will not discriminate against you for exercising these rights

WHOOP says it will not discriminate against you for exercising the rights described in the Notice.

Supporting quotations

We will not discriminate against you for exercising your rights described above.

Qualifications & exceptions

• The commitment is about the rights described in this Notice.

Not stated here

• The Notice does not define what counts as discrimination.

Legal Rights & Agreement Rules · Restriction or exception

If WHOOP processes data for a HIPAA covered entity, that entity's privacy notice governs

To the extent WHOOP processes your personal information while providing services on behalf of a 'covered entity' under the Health Insurance Portability and Accountability Act (HIPAA), WHOOP says that processing is governed by the covered entity's Notice of Privacy Practices. If the WHOOP Privacy Policy and that Notice of Privacy Practices conflict, the covered entity's Notice of Privacy Practices governs. Elsewhere in this Notice, a conflict between the WHOOP Privacy Policy and this Consumer Health Data Notice is resolved in favor of this Notice.

Supporting quotations

To the extent that we process your personal information in connection with our providing services on behalf of a “covered entity” under the Health Insurance Portability and Accountability Act, our processing of your personal information in that context will be governed by the Notice of Privacy Practices of the relevant covered entity. In the event of a conflict between our Privacy Policy and the relevant Notice of Privacy Practices, the relevant Notice of Privacy Practices will govern.

In the event of a conflict between our Privacy Policy and this Notice, this Notice controls.

Qualifications & exceptions

• This rule applies only to processing done on behalf of a HIPAA covered entity.
• It is a narrower situation than the general rule that this Notice controls over the Privacy Policy.

Not stated here

• The covered entity's Notice of Privacy Practices is a separate document and is not part of this analysis; WHOOP's Connected Care documents are separate agreements on the same site.

Cross-references

• narrows (model-proposed): This Notice supplements the Privacy Policy and controls if the two conflict — exception_to: The Notice controls over the Privacy Policy in a conflict, except that for processing on behalf of a HIPAA covered entity, the covered entity's Notice of Privacy Practices governs a conflict with the Privacy Policy.

Account & Service Control · Procedure

Contact WHOOP's privacy team at privacy@whoop.com or by mail to its Boston legal department

For questions about this Notice or its privacy practices, WHOOP says you may contact the WHOOP Privacy Team by email at privacy@whoop.com or by mail to Whoop, Inc., Attn: Legal Department, One Kenmore Square, #601, Boston, MA 02215.

Supporting quotations

If you have any questions about this Notice or our privacy practices, you may contact us at:

WHOOP Privacy Team Email: privacy@whoop.com Whoop, Inc., Attn: Legal Department, One Kenmore Square, #601 Boston, MA 02215