Privacy Policies — Privacy Principles, Messaging Privacy Policy, CCPA and Consumer Health Data Privacy Notice

Sharing & Disclosure · Company commitment

Beyond what the Privacy Policy describes, WHOOP says it shares your data only if you ask

WHOOP says its Privacy Policy describes how it shares personal data and that it will otherwise share your personal data with others only if you ask it to. The example given is sharing with an organization that manages a corporate wellness program, which WHOOP would do if you specifically authorized it.

Supporting quotations

Our Privacy Policy describes how we share personal data. We will otherwise share your personal data with others only if you ask us to. For example, we would share it with an organization managing a corporate wellness program if you specifically authorized us to do so.

Qualifications & exceptions

• The commitment is framed around sharing 'otherwise' than as the Privacy Policy describes, so it depends on what that policy allows.
• The corporate wellness example requires your specific authorization.

Not stated here

• What sharing the full Privacy Policy permits is not in this analysis, so the size of the 'otherwise' category cannot be judged here.

Sharing & Disclosure · Company commitment

WHOOP says it never sells member data, while confirming third-party cookies and tracking

Under the heading that WHOOP does not sell member personal data, WHOOP says it never sells its members' personal data and calls this its promise. In the same passage it says that, because the CCPA defines 'sale' so broadly, it wants to be clear that it uses third-party cookies and other tracking technologies. The CCPA section later on the page repeats that WHOOP does not sell personal information and adds that WHOOP's services provide, and its partners use, automated technologies such as cookies to understand how people use its products and services and to support advertising.

Supporting quotations

WHOOP DOES NOT SELL MEMBER PERSONAL DATA

we never sell our members’ personal data. This is our promise.

Because of how broadly the CCPA defines “sale,” we want to be clear that we use third party cookies and other tracking technologies.

We do not sell personal information.

Our Services provide and our partners use automated technologies, such as cookies, to understand how people use our products and Services and to support advertising.

Qualifications & exceptions

• The no-sale promise is made about members' personal data; WHOOP separately acknowledges third-party cookies and tracking technologies and, in the CCPA section, advertising support.

Not stated here

• The passage does not say whether WHOOP treats any cookie-based or advertising data flow as a 'sale' under the CCPA, so the practical effect of the promise on those flows is not stated here.
• How to limit these technologies is left to the full Privacy Policy, which is not part of this analysis.

Sharing & Disclosure · Company commitment

WHOOP says it will never voluntarily disclose member data to authorities or litigants

WHOOP notes that it may receive requests for member data from governmental entities, including law enforcement, and from private parties engaged in civil litigation. It says it will never voluntarily disclose member data in response to such a request by a governmental entity or civil litigant, and will never give any governmental entity or civil litigant direct access to its members' data.

Supporting quotations

Like all other companies, WHOOP may from time to time receive requests for member data from third parties, like governmental entities (including law enforcement) and private parties engaged in civil litigation.

WHOOP will never voluntarily disclose member data in response to a request by a governmental entity or civil litigant.

WHOOP will never provide any governmental entity or civil litigant with direct access to our members data.

Qualifications & exceptions

• The commitments are about responding to requests from governmental entities and civil litigants; they sit alongside the stricter-conditions commitment on copies in the next card.

Not stated here

• Other sections of this page (the Messaging Privacy Policy and the Consumer Health Data Privacy Notice) describe disclosures to authorities on a good-faith belief that disclosure is necessary or appropriate; these principles do not address how those statements fit together.

Cross-references

• contrast (model-proposed): WHOOP may disclose messaging information to comply with law, answer authorities or protect rights — The Privacy Principles say WHOOP will never voluntarily disclose member data in response to a governmental or litigant request, while the Messaging Privacy Policy says WHOOP may disclose information to respond to requests from public and government authorities when it believes disclosure is necessary or appropriate. The page does not say how the two fit together; they cover different data (member data generally versus Messaging Service information).
• contrast (model-proposed): WHOOP may share consumer health data with authorities or other third parties on a good-faith belief it is necessary — The Privacy Principles say WHOOP will never voluntarily disclose member data in response to a governmental or litigant request, while the Consumer Health Data Privacy Notice says WHOOP may share consumer health data with law enforcement and government agencies where it believes in good faith that this is necessary or appropriate. The page does not reconcile the two; the Notice's priority clause names only the Privacy Policy.

Sharing & Disclosure · Company commitment

Copies of member data go to authorities or litigants only on a valid, binding, narrow request

WHOOP says it will never provide copies of member data to any governmental entity or civil litigant without a valid, narrowly tailored and legally binding request, with a subpoena, warrant or court order given as examples. It says it is prepared to fight to protect its members' privacy in court if necessary, and will reject, challenge or object to any data access request from a governmental entity or civil litigant that it believes is invalid, overly broad, unclear or otherwise inappropriate.

Supporting quotations

WHOOP will never provide copies of member data held by WHOOP to any governmental entity or civil litigant without a valid, narrowly tailored, and legally-binding request (e.g., subpoena, warrant or court order).

WHOOP is prepared to fight to protect our members privacy in court if necessary. We will reject, challenge or object to any data access request from a governmental entity or civil litigant that we believe is invalid, overly broad, unclear or otherwise inappropriate.

Qualifications & exceptions

• Subpoena, warrant and court order are listed as examples ('e.g.'), not as an exhaustive list of qualifying requests.
• The commitment to challenge applies to requests WHOOP itself believes are invalid, overly broad, unclear or otherwise inappropriate.

Not stated here

• The passage does not say what WHOOP does with a request it considers valid beyond not providing copies without one.

Sharing & Disclosure · Permission or license

WHOOP may share your messaging information with consent or with service providers

WHOOP says it may share, transfer or disclose your information if you consent, as well as in the listed circumstances. One circumstance is service providers: WHOOP may share your information with third parties to help it provide the Messaging Service to you.

Supporting quotations

We may share, transfer, or disclose your information, if you consent to us doing so, as well as in the following circumstances:

Service Providers. We may share your information with third parties to help us provide the Messaging Service to you.

Qualifications & exceptions

• The permission is framed as 'may' and is limited to helping provide the Messaging Service.

Not stated here

• Who the service providers are, and what limits apply to their use of the information, is not stated.

Sharing & Disclosure · Permission or license

WHOOP may disclose messaging information to comply with law, answer authorities or protect rights

WHOOP says it may disclose your information where it believes disclosure is necessary or appropriate to: (i) comply with applicable law and legal processes; (ii) respond to requests from public and government authorities, including authorities outside your country of residence; (iii) enforce a contract with it; (iv) protect its rights, privacy, safety or property, or that of its affiliates, you or others; and (v) allow it to pursue available remedies or limit damages it may sustain.

Supporting quotations

Legal Requirement and Protection of Iterable and Others. We may disclose your information as we believe such disclosure is necessary or appropriate to: (i) comply with applicable law and legal processes; (ii) respond to requests from public and government authorities, including public and government authorities outside your country of residence; (iii) enforce a contract with us; (iv) protect our rights, privacy, safety, or property, and/or that of our affiliates, you or others; and (v) allow us to pursue available remedies or limit the damages that we may sustain.

Qualifications & exceptions

• The test is WHOOP's own belief that disclosure is necessary or appropriate.
• Authorities outside your country of residence are expressly included.

Not stated here

• The label for this item refers to protection of 'Iterable and Others' while the text speaks of 'our' rights; the passage does not explain whose rights beyond those listed it covers.
• This policy covers the Messaging Service; the Privacy Principles earlier on the page describe a stricter stance toward requests from authorities, and the passage here does not address how the two fit together.

Cross-references

• contrast (model-proposed): WHOOP says it will never voluntarily disclose member data to authorities or litigants — The Privacy Principles say WHOOP will never voluntarily disclose member data in response to a governmental or litigant request, while the Messaging Privacy Policy says WHOOP may disclose information to respond to requests from public and government authorities when it believes disclosure is necessary or appropriate. The page does not say how the two fit together; they cover different data (member data generally versus Messaging Service information).

Sharing & Disclosure · Permission or license

Aggregated or de-identified messaging information may go to any third party, including advertisers

WHOOP says that from time to time it may share aggregate or de-identified information about use of the Messaging Service, and that this aggregated or de-identified information may be shared with any third party, including advertisers, promotional partners and sponsors.

Supporting quotations

From time to time, we may share aggregate or de-identified information about use of the Messaging Service and such aggregated or de-identified information may be shared with any third party, including advertisers, promotional partners, and sponsors.

Qualifications & exceptions

• This applies to aggregate or de-identified information about use of the Messaging Service, not to identifiable information.

Not stated here

• The passage does not describe how the information is aggregated or de-identified, or limit what recipients may do with it.

Sharing & Disclosure · Context

'Third Parties' include service providers WHOOP relies on and advertisers serving interest-based ads

WHOOP defines Third Parties as entities or businesses involved in an arrangement, contract, deal or transaction who are not one of the principals, meaning WHOOP or WHOOP Members. It says it uses Third Parties to do business with members, such as charging for transactions or storing data, and that Third Parties also include advertisers that serve interest-based ads to visitors to its website.

Supporting quotations

Third Parties in the context of the relationship between WHOOP, WHOOP Members (our end users), and third parties are entities or businesses involved in an arrangement, contract, deal, or transaction but are not one of the principals (i.e., WHOOP or WHOOP Members).

We use Third Parties to enable us to do business with our members, such as charging for transactions or storing data. Third Parties also include advertisers that serve interest-based ads to visitors to our website.

Qualifications & exceptions

• Advertisers serving interest-based ads to website visitors are included in the definition of Third Parties.

Not stated here

• Which specific Third Parties receive which data is left to the Privacy Policy, which is a linked document not part of this analysis.

Sharing & Disclosure · Company commitment

CCPA section: WHOOP does not sell personal information; it and partners use cookies for advertising

In its CCPA section WHOOP says it takes the privacy of its Members and Customers seriously and does not sell personal information. It also says its Services provide, and its partners use, automated technologies such as cookies to understand how people use its products and Services and to support advertising, and that you can learn how to limit these technologies in its Privacy Policy. 'Services' means WHOOP's websites, mobile apps, software embedded in the WHOOP Strap and related features.

Supporting quotations

At WHOOP, we take the privacy of our Members and Customers seriously. We do not sell personal information.

Our Services provide and our partners use automated technologies, such as cookies, to understand how people use our products and Services and to support advertising.

Services means, collectively, our websites and mobile apps, any software embedded within the WHOOP Strap, and any features, content, or applications offered, from time to time, by WHOOP in connection therewith.

Qualifications & exceptions

• The no-sale statement and the advertising-technology statement appear together; the section does not say whether WHOOP treats the advertising-related data flows as a 'sale'.

Not stated here

• How to limit these technologies is left to the full Privacy Policy, which is not part of this analysis.
• The section does not name the partners or say what data the cookies collect.

Sharing & Disclosure · Company commitment

WHOOP says it does not sell consumer health data; personalization stays inside WHOOP and is not used for third-party ads

WHOOP says it does not sell your consumer health data to third parties. It says any personalization based on your health data occurs within WHOOP and is not used for third-party advertising. Where required by applicable law, it says it will obtain your consent before using consumer health data for marketing or promotional purposes.

Supporting quotations

We do not sell your consumer health data to third parties.

Any personalization based on your health data occurs within WHOOP and is not used for third-party advertising. Where required by applicable law, we will obtain your consent before using consumer health data for marketing or promotional purposes.

Qualifications & exceptions

• The consent commitment applies 'where required by applicable law'.
• These statements concern consumer health data; the Notice separately lists categories of recipients in the Data Sharing section.

Not stated here

• The Notice does not say whether any use of consumer health data for WHOOP's own marketing occurs where consent is not required by law.

Sharing & Disclosure · Permission or license

WHOOP may share consumer health data with service providers, including labs and clinical providers you direct it to use

WHOOP says it may share your consumer health data with service providers or processors it works with to provide the Services, including third-party laboratory and clinical service providers when you direct it to obtain or integrate your test results, biomarkers or other clinical data into its platform.

Supporting quotations

We may share your consumer health data with:

Service providers or processors we collaborate in order to provide the Services, including third-party laboratory and clinical service providers when you direct us to obtain or integrate your test results, biomarkers, or other clinical data into our platform;

Qualifications & exceptions

• Sharing with laboratory and clinical providers is described as happening when you direct it.

Not stated here

• The providers and processors are not named, and the section does not limit what they may do with the data.

Sharing & Disclosure · Permission or license

WHOOP may share consumer health data with authorities or other third parties on a good-faith belief it is necessary

WHOOP says it may share your consumer health data with law enforcement, government agencies or other third parties where it believes in good faith that doing so is necessary or appropriate to comply with applicable laws or protect its legitimate interests.

Supporting quotations

We may share your consumer health data with:

Law enforcement, government agencies or other third parties, where we believe in good faith it is necessary or appropriate to comply with applicable laws or protect our legitimate interests;

Qualifications & exceptions

• The test is WHOOP's good-faith belief that sharing is necessary or appropriate.
• Protecting 'legitimate interests' is a separate basis from complying with laws.

Not stated here

• The Privacy Principles earlier on the page describe WHOOP as never voluntarily disclosing member data in response to government or litigant requests and sharing copies only on a valid binding request; this Notice's wording is broader and the page does not explain how the two fit together.

Cross-references

• contrast (model-proposed): WHOOP says it will never voluntarily disclose member data to authorities or litigants — The Privacy Principles say WHOOP will never voluntarily disclose member data in response to a governmental or litigant request, while the Consumer Health Data Privacy Notice says WHOOP may share consumer health data with law enforcement and government agencies where it believes in good faith that this is necessary or appropriate. The page does not reconcile the two; the Notice's priority clause names only the Privacy Policy.

Sharing & Disclosure · Permission or license

If WHOOP is sold or merged, your consumer health data may go to the new owner, with reasonable efforts to tell you first

WHOOP says it may share your consumer health data with business transferees in the event of a merger, sale, acquisition, bankruptcy or other transaction in which that third party assumes control of WHOOP's business or data, in whole or in part. If such an event occurs, WHOOP says it will make reasonable efforts to notify you before your consumer health data becomes subject to different privacy and security policies and practices.

Supporting quotations

Business transferees, in the event of a merger, sale, acquisition, bankruptcy or other transaction in which that third party assumes control of our business or data (in whole or in part). Should one of these events occur, we will make reasonable efforts to notify you before your consumer health data becomes subject to different privacy and security policies and practices; and

Qualifications & exceptions

• The notice commitment is to 'reasonable efforts', not a guarantee of advance notice.
• Control of data 'in whole or in part' is enough to trigger the provision.

Not stated here

• The notice does not say how you would be told or whether you could object.

Sharing & Disclosure · Permission or license

WHOOP may share consumer health data with other third parties with your consent or at your direction

WHOOP says it may share your consumer health data with other third parties with your consent or at your direction.

Supporting quotations

Other third parties, with your consent or at your direction.