Privacy Policies — Privacy Principles, Messaging Privacy Policy, CCPA and Consumer Health Data Privacy Notice

Security & Safeguards · Company commitment

WHOOP staff may access your personal data only with a legitimate business need

WHOOP says it is its policy that a member's personal data is not to be accessed or shared by anyone at WHOOP without an explicit need. It lists membership services representatives, management team members, data scientists and technical team members as people who are not permitted to access your personal data without a legitimate business need.

Supporting quotations

Our policy is that a member’s personal data is not to be accessed or shared by anyone at WHOOP without an explicit need to do so.

WHOOP membership services representatives, management team members, data scientists and technical team members are not permitted to access your personal data without a legitimate business need.

Qualifications & exceptions

• The restriction turns on 'a legitimate business need' (and 'an explicit need' in the general statement); the passage does not define those terms or list the permitted needs.

Not stated here

• Who decides what counts as a legitimate business need, and any independent checking of that decision, is not described in this section.

Security & Safeguards · Company practice

WHOOP logs who accesses member data and investigates anomalies

WHOOP says it maintains a log of who has accessed member personal data and when, and that it actively evaluates the data access logs and investigates any anomalies in data access.

Supporting quotations

We maintain a log that tells us who has accessed member personal data and when.

We actively evaluate data access logs and investigate any anomalies for data access.

Not stated here

• How often logs are reviewed, who reviews them, and what follows an investigation are not stated.

Security & Safeguards · Company practice

WHOOP says it uses physical, technical, administrative and organizational security measures

WHOOP says it takes a variety of physical, technical, administrative and organizational security measures, based on the sensitivity of the information it collects, to protect your information against accidental or unlawful destruction, accidental loss, alteration, and unauthorized disclosure or access.

Supporting quotations

We take a variety of physical, technical, administrative, and organizational security measures based on the sensitivity of the information we collect to protect your information against accidental or unlawful destruction or accidental loss, alteration, unauthorized disclosure or access.

Qualifications & exceptions

• The level of measures is tied to the sensitivity of the information collected.

Not stated here

• The measures themselves are not described.

Security & Safeguards · Restriction or exception

WHOOP does not guarantee security and does not accept liability for unintentional disclosure

WHOOP says no online activity can be guaranteed to be 100% secure and that, although it strives to protect your information against unauthorized use or disclosure, it cannot ensure or warrant the security of any information you provide. It also states that it does not accept liability for unintentional disclosure.

Supporting quotations

Unfortunately, no online activity can be guaranteed to be 100% secure. While we strive to protect your information against unauthorized use or disclosure, we cannot ensure or warrant the security of any information you provide. We do not accept liability for unintentional disclosure.

Qualifications & exceptions

• The liability statement is about unintentional disclosure; the passage does not address other kinds of disclosure.

Not stated here

• How far this disclaimer is enforceable is a legal question outside what the document says.

Security & Safeguards · Context

The Security section is for researchers; members with account security issues should contact Membership Services

WHOOP says its security site provides information for researchers and security professionals, and that a WHOOP member experiencing a security issue with their account should contact Membership Services instead. The section opens by saying that WHOOP manages personal and sensitive data of its members like other companies providing wearable devices and health monitoring services, that it takes privacy seriously, and that it has a responsibility to protect the privacy of members' data.

Supporting quotations

If you are a WHOOP member and are experiencing a security issue with your account please contact

This site provides information for researchers and security professionals.

Like all companies providing wearable devices and health monitoring services, WHOOP manages personal and sensitive data of our members. We take privacy seriously, and understand that we have a responsibility to protect the privacy of our members’ data.

Qualifications & exceptions

• The member route (Membership Services) is separate from the researcher route for vulnerability reports.

Not stated here

• The introduction states values and responsibilities in general terms; it does not describe specific security controls.

Security & Safeguards · Procedure

WHOOP accepts vulnerability reports and sends back a tracking identifier

WHOOP says it openly accepts vulnerability reports for its WHOOP platform and products. If you believe you have found a vulnerability, or have a security incident to report, you are asked to contact WHOOP through its vulnerability disclosure form, and on receipt WHOOP says it will reply with a tracking identifier. The link at the end of the section, labelled Submit, points to a HackerOne page named whoop_bug_bounty.

Supporting quotations

WHOOP openly accepts vulnerability reports for our WHOOP platform and products. If you believe you have discovered a vulnerability in a WHOOP platform or product, or if you have a security incident to report, please contact us our vulnerability disclosure form below. Upon receipt of your message, we will send a reply that includes a tracking identifier.

Submit

Qualifications & exceptions

• The form is described as 'below' the text; the Submit link is at the end of the Security section.

Not stated here

• The passage does not say how long WHOOP takes to respond beyond the tracking identifier reply, or what it does with reports.

Security & Safeguards · Company practice

WHOOP's disclosure policy uses a 90-day deadline that can move for weekends, pending patches or extreme circumstances

WHOOP says vulnerability disclosure is a two-way street and that it adheres to a 90-day disclosure deadline. It says it notifies vendors of vulnerabilities immediately, with details shared publicly with the defensive community after the Deadline, or sooner if the vendor releases a fix. The Deadline can vary: if it would expire on a weekend or U.S. public holiday it moves to the next regular work day; if a vendor says before the Deadline expires that a patch is scheduled within 14 days after the Deadline, WHOOP will delay public disclosure until the patch is available; and WHOOP reserves the right to bring the Deadline forward or backward based on extreme circumstances. It says it treats all vendors strictly equally and expects to be held to the same standard.

Supporting quotations

WHOOP adheres to a 90-day disclosure deadline (the “Deadline”). We notify vendors of vulnerabilities immediately, with details shared in public with the defensive community after the Deadline, or sooner if the vendor releases a fix. That Deadline can vary in the following ways:

If a Deadline is due to expire on a weekend or U.S. public holiday, the Deadline will be moved to the next regular work day.

Before the Deadline has expired, if a vendor lets us know that a patch is scheduled for release on a specific day that will fall within 14 days following the Deadline, we will delay the public disclosure until the availability of the patch.

As always, we reserve the right to bring the Deadline forward or backward based on extreme circumstances. We remain committed to treating all vendors strictly equally. WHOOP expects to be held to the same standard.

Qualifications & exceptions

• The 14-day patch extension depends on the vendor telling WHOOP before the Deadline expires that a patch is scheduled for a specific day.
• The reservation to move the Deadline is for 'extreme circumstances'.
• Actively exploited, previously unknown vulnerabilities follow a shorter timeline (see the 7-day card).

Not stated here

• The text is written about WHOOP notifying vendors of vulnerabilities and sharing details publicly; it does not spell out whether, and how, the same deadline applies to vulnerabilities reported to WHOOP about its own products.

Security & Safeguards · Company practice

For actively exploited unknown vulnerabilities, WHOOP uses a 7-day timeline before supporting disclosure

When WHOOP observes a previously unknown and unpatched vulnerability in software that is under active exploitation (a '0day'), it says more urgent action, within 7 days, is appropriate. It gives the reason that each day an actively exploited vulnerability stays undisclosed and unpatched, more devices or accounts are compromised. After 7 days without a patch or advisory, WHOOP says it will support researchers making details available so users can take steps to protect themselves. WHOOP acknowledges that seven days is aggressive and may be too short for some vendors to update their products.

Supporting quotations

When we observe a previously unknown and unpatched vulnerability in software under active exploitation (a “0day”), we believe that more urgent action - within 7 days - is appropriate.

after 7 days have elapsed without a patch or advisory, we will support researchers making details available so that users can take steps to protect themselves.

Qualifications & exceptions

• The 7-day timeline applies to previously unknown, unpatched vulnerabilities in software under active exploitation that WHOOP observes.
• WHOOP says the time should be enough to publish advice on mitigations such as temporarily disabling a service, restricting access or contacting the vendor.

Not stated here

• The text does not say whether the 7-day path is used for vulnerabilities in WHOOP's own products.