WHOOP Privacy Principles

We take your privacy seriously and want you to understand how we use, collect and share data that identifies or relates to you as an individual (which we call “personal data”), and the measures we take to protect your personal data. We have invested heavily, and will continue to invest, in features and security to protect the privacy and security of your personal data. We continually evaluate our privacy practices to ensure that we treat your personal data in compliance with applicable privacy laws like the California Consumer Privacy Act and the General Data Protection Regulation. You can find more detailed information about ways in which we use, collect, and share personal data in our full Privacy Policy.

1. WHOOP MEMBERS CONTROL THEIR PERSONAL DATA

We believe you should be in control of your personal data. Consistent with this belief:

• We will delete your personal data if you ask us to, including if asked when you cancel your membership.
• We will provide you with access to your personal data if you ask us to, including if asked when you cancel your membership.
• We will share your personal data with others if you ask us to. For example, we would share it with an organization managing a corporate wellness program if you specifically authorized us to do so.

2. WHOOP EMPLOYEES ONLY ACCESS MEMBER PERSONAL DATA WHEN REQUIRED TO PROVIDE SERVICES AND SUPPORT

We prioritize the accountability and the security of your personal data. Our policy is that a member’s personal data is not to be accessed or shared by anyone without an explicit need to do so. Consistent with these priorities and our policy:

• WHOOP membership services representatives, data scientists and technical team members cannot access your personal data without a legitimate business need.
• We maintain a log that tells us who has accessed member personal data and when.
• We actively evaluate data access logs and investigate any anomalies for data access.

3. WHOOP DOES NOT MONETIZE MEMBER PERSONAL DATA

Our business model is to provide highly valuable product experiences and services to our members in exchange for membership fees. As such, we never monetize our members’ personal data by distributing it to other parties, period. This is our promise.

4. WHOOP USES ONLY AGGREGATED OR DE-IDENTIFIED WELLNESS DATA TO BETTER UNDERSTAND HUMAN PERFORMANCE

Our members provide us with an unprecedented amount of accurate physiological data that is collected by their WHOOP strap. This information includes heart rate, heart rate variability, sleep duration, respiratory rate, data such as the type of activity engaged in and the duration of physical activity, and any additional information members chose to enter when using WHOOP services (collectively, we call this “wellness data”).

We use aggregated or de-identified wellness data that no longer identifies a particular individual (and is thus no longer personal data) to help answer important questions about human performance and further explore what it means to be optimal. We believe we have a responsibility to create an ever-better experience for our members by identifying and sharing cutting edge insights. We will always look to provide new content and product features, improve and customize our services (including determining and reporting on trends, sleep, strain and recovery), and develop thought leadership in the area of human performance. We hope your experience with WHOOP will improve over time as our membership base grows and we continue with our mission to unlock human performance.

We know privacy and security are important to you. We are committed to making WHOOP the best tool to monitor and understand the body. We will continue to be transparent about our privacy and security practices as we grow alongside our membership.