Wellness & Meditation Apps · Fitness Wearable · Structural / no discrete incident
Whoop
Headline
Whoop is worn 24 hours a day and produces continuous heart rate, heart rate variability, respiratory rate, skin temperature and sleep staging - a physiological record more granular than most people's medical charts…
Not independently verified. Verification status: Unverified - heuristic first draft. Publish state: draft unverified.
Whoop is worn 24 hours a day and produces continuous heart rate, heart rate variability, respiratory rate, skin temperature and sleep staging - a physiological record more granular than most people's medical charts, generated outside any clinical relationship and therefore outside HIPAA. The subscription model is also structurally unusual: the hardware is bundled into a membership, so lapsing means the device stops being useful, which is a retention mechanism rather than a product design. Continuous biometric monitoring of this kind has obvious value to insurers and employers, and the meaningful protections are contractual rather than statutory. See the Data Sharing column for the itemised findings.
- Severity
- Evidence tierUnassigned
- Claims confirmed
- Last verified2026-08-04
Primary source. None recorded — Unverified - heuristic first draft.
Terms
Arbitration
Not independently confirmed this pass — standard binding arbitration + class action waiver expected. SEPARATE, EARLIER CLASS ACTION (Oct 2023): accuses Whoop of unlawfully enrolling consumers in recurring paid memberships WITHOUT CONSENT — a distinct billing-practices claim.
Data sharing
SIGNIFICANT, MULTI-FACETED FINDINGS for a device worn 24/7: an August 2025 proposed class action (Lomeli v. Whoop, N.D. Cal.) alleges Whoop embedded a third-party tracker (Segment) in its app that disclosed users' names, emails, health metrics and the titles of health videos watched, without consent — asserting claims under the federal Video Privacy Protection Act and California's Confidentiality of Medical Information Act (allegations, not findings; early-stage as of mid-2026). An academic study comparing wearable manufacturers' privacy policies has been reported to place Whoop in a higher privacy-risk group (publication and ranking not verified this pass; confirm before citing). Whoop's current privacy policy (last updated Aug 3 2026) includes a HIPAA Notice section stating that a separate Notice of Privacy Practices governs personal information processed in connection with certain clinical services (e.g., its Connected Care offering); outside those services, the extensive health data it collects (heart rate variability, respiratory rate, blood oxygen, sleep staging, lab results obtained through its 'Advanced Labs' program from third-party laboratory partners with explicit consent, plus user-entered 'female health tracking' data) generally falls outside HIPAA. The policy states Whoop does not sell personal data or consumer health data, while disclosing cookie-based sharing with advertising partners. A fitness-tech reviewer has been reported (not verified this pass) to have publicly challenged Whoop's CEO around 2020 over the gap between marketing claims ('never sells data') and the actual privacy policy text, which the reviewer said explicitly listed data that HAD been sold; Whoop's later clarification amounted to 'they only give it away instead' per the reviewer.
Fees and billing
SEPARATE, RECENT CLASS ACTION (Nov 2025): alleges Whoop's blood-pressure-adjacent features do NOT provide the 'medical-grade' health insights the company advertises — a product-accuracy/marketing claim distinct from the privacy findings above (Rowe v. Whoop; early-stage). Related: FDA issued a warning letter on Jul 14 2025 treating Blood Pressure Insights as an uncleared medical device, then closed it out on Jun 17 2026 after Whoop modified the feature (per secondary reporting).
Contacts
Privacy contact. Not recorded.
Legal notice. Not verified this pass. If publicly traded: SEC Form 10-K cover page gives the official corporate address; the Secretary of State business-entity search in the state of incorporation gives the registered agent, which must accept service. If private: the state registered agent is usually the only reliable route.
Mailing address. Not recorded.
Evidence
No claims have been itemized for this row yet.
No sources are on file for this row yet.
Source vault
Link status: Candidate - not yet fetched
| Document | Last fetch | |
|---|---|---|
| Privacy policy whoop.com/us/en/full-privacy-policy/ | Not fetched yet | NO (HTML only) |
| Terms of service whoop.com/us/en/terms/ | Not fetched yet | NO (HTML only) |
| Website No URL recorded | Not fetched yet | — |
| Primary source No URL recorded Verification: Unverified - heuristic first draft | Not fetched yet | — |
Enforcement
No enforcement actions are linked to this row.
State statute
No HQ state on file, so no state statute applies by headquarters.