The Countersign

Whoop’s terms, not its privacy policy, let it train AI on members’ data

Whoop’s chief executive says the company is building its own foundation models on 50 billion hours of members’ physiological data. We traced Whoop’s legal documents through archived copies: the explicit right to train AI was written into its terms in October 2025, after years of licenses that never mentioned it, and none of the settings Whoop describes is said to switch it off.

Reported and edited by Sam Calder

Published 9 min read

“On average, a Whoop member wears Whoop 23.6 hours a day,” Will Ahmed, Whoop’s founder and chief executive, said in an All-In podcast interview published on October 29, 2026. “We have just over 50 billion hours of continuous physiological data. So it’s one of the largest health data sets in the world.”1

When the interviewer asked whether AI companies wanted to buy that data, Ahmed said Whoop was building its own models. “Today we’re building our own models, you know, foundational models within the company that are essentially training on top of this data,” he said. He also mentioned open source models, without saying how Whoop uses them.1

He went on to the other data Whoop now holds: members are “uploading their blood tests or they’re doing Advanced Labs through Whoop. They’re uploading medical records.”1

Listen Will Ahmed on Whoop’s data, and the AI models it is building

All-In Podcast, October 29, 20261from 19:15 in the episode

Show transcriptHide transcript
  1. 0:00

    Will Ahmed On average, a Whoop member wears Whoop 23.6 hours a day. And as a consequence, we have just over 50 billion hours of continuous physiological data. So it’s one of the largest health data sets in the world.

  2. 0:16

    Will Ahmed And now with the, you know, the advent of AI and what you can do with large data sets, it’s just like a really exciting time to be working in this space.

  3. 0:25

    Jason Calacanis Do all the AI companies, like the frontier models, want to buy this data from you in aggregate? Is that like a huge business for you guys eventually? How do you think about that, or building your own models?

  4. 0:36

    Will Ahmed Yeah. Today we’re building our own models, you know, foundational models within the company that are essentially training on top of this data.

  5. 0:44

    Jason Calacanis So, so you’re using open source models, or you’re…

  6. 0:46

    Will Ahmed …we’re developing our own models. You’ve got open source models. And what’s amazing is you’ve got this huge physiological data set, but then you also now have other data sets, right? So people are uploading their blood tests or they’re doing Advanced Labs through Whoop. They’re uploading medical records.

Transcript checked against the audio by Sam Calder on November 4, 2026. Listen to the full episode.

Whoop sells a screenless band, worn around the clock, that measures heart rate, sleep and activity, as a subscription.2 In March it said it had more than 2.5 million members2; Ahmed told the podcast he expects to end the year with about 4 million.1

We set out to find what those members have agreed to. We read Whoop’s current privacy policy, terms of use and help pages, and traced earlier versions through copies kept by the Internet Archive: the privacy policy back to 2015, the terms back to 2023.

Whoop’s explicit permission to train AI on members’ data is in its terms of use. It first appears in the version dated October 9, 2025.3 The privacy policy, including the current version dated August 3, 2026, never says Whoop may train its own AI models on members’ data. The only training it has mentioned since November 2023 is a promise that the outside company behind Whoop’s AI coach won’t use members’ data to train any AI.45 And none of the settings Whoop describes to members is said to keep their data out of training.67

Training AI on customers’ data is common in the industry, and nothing we found suggests Whoop sells its members’ data. Its privacy policy has said since 2021 that it doesn’t,85 and Ahmed told the podcast: “We do not sell data, you know, you are not the product.”1 What stands out is where Whoop’s permission to train sits, when it was spelled out and how much data it may now cover.

What changed in October 2025

“We feel like we’ve earned the right to accumulate all this data because we have very strong data policies,” Ahmed told the podcast.1 Those policies have changed over time.

Listen Will Ahmed on Whoop’s data policies

All-In Podcast, October 29, 20261from 42:44 in the episode

Show transcriptHide transcript
  1. 0:00

    Will Ahmed And it’s also worth saying that we feel like we’ve earned the right to accumulate all this data because we have very strong data policies. So, we do not sell data, you know, you are not the product, Jason, like you’re, the membership is the product.

Transcript checked against the audio by Sam Calder on November 4, 2026. Listen to the full episode.

Whoop’s terms have long claimed broad rights over what members put into its service. In every copy we checked from August 2023 to mid-April 2025, members granted Whoop a perpetual license to “aggregate, use, reproduce, distribute, prepare derivative works of, modify, display, perform, publish and otherwise commercially exploit” their content, which the terms said included “any information collected by the WHOOP Device.”9 Those terms defined “AI Technology” from late 2023 but gave Whoop no license to train it.9

By May 2025 the license was narrower. The version dated September 30, 2025, listed what Whoop could do with members’ content and told them: “If you wish to remove your User Content and terminate our license to your User Content, please contact privacy@whoop.com.”10

The version dated October 9, 2025, replaced it. Members now grant Whoop “a perpetual, worldwide, non-exclusive, royalty-free, fully paid-up, sublicensable (through multiple tiers of sublicensees) and transferable right” to their content, “for the purposes of operating and providing the Services to you and to our other users and, solely in aggregate and deidentified form, to train any AI Technology models.”311 The same version said this content “may include lab results and other documentation resulting from the Tests you receive,” meaning the blood tests Whoop sells; the current version adds “reports” to that list.311 The option to end the license by email is gone.

The current terms define members’ content as what they “upload, post, email, transmit or otherwise make available” through the service, and no longer name information collected by the band.11 So it isn’t clear from the terms whether the band’s continuous readings fall under the training license. Whoop’s privacy policy has, since 2021, separately allowed it to use “aggregated data or de-identified Data” for research and development, “to improve and add features to the Services.”85 Whoop could say that training was covered all along. But the privacy policy never says Whoop itself trains AI models on members’ data. It discusses AI only when describing the coach, which it calls “a generative AI feature,” and a similar assistant for member support, and mentions training only to rule it out for the outside partner whose model runs them.5

Since October 2025 Whoop’s terms have said that if a change is material, Whoop will email members an updated copy; that changes take effect for members after 30 days or when they accept them, whichever comes first; and that members who reject a change within 30 days stay under the old terms until their current membership ends, after which the new terms apply unless they cancel.311 The terms in force before then promised no email; they let members cancel for a pro-rated refund after a material change.10 We don’t know whether Whoop treated the October 2025 change as material or emailed members about it.

The line added to Whoop’s blog

Whoop’s clearest statement about training is on its blog. A post titled “How WHOOP AI guidance turns your health data into personalized coaching,” dated April 30, 2026, says in its frequently asked questions: “WHOOP uses anonymized member data for AI model training, and individual health records are not exposed in identifiable form.”7

That sentence wasn’t always there. The Archive’s earliest copy, from February 2026, shows the post dated October 16, 2025, with no questions section.12 By May 2026 it carried the April 30 date, and the Archive’s last full copy, from June 13, 2026, still had no sentence about model training.13 It was added after that, under the same April date.

Is there a way out?

Whoop describes several controls. A “Personalized Product Recommendations” switch in the app’s privacy settings stops Whoop using a member’s data “for personalized product recommendations.” A coaching mode called “Education and Support Only” makes Whoop’s AI coach give generic advice “not based on your specific data.” A feature called My Memory lets members see and delete what the coach remembers about them.6 Whoop’s blog adds that members “can opt out of WHOOP AI at any time in the app settings.”7 None of these is described as keeping a member’s data out of research or model training.

Deleting an account may not do that either. Whoop’s privacy policy says it may keep “aggregated data or de-identified data derived from or incorporating your Personal Data that does not identify you after you update or delete it.”5

Whoop defines de-identified data as data from which “all the personally identifiable information has been removed,” and says it “is no longer Personal Data.”14 None of its current documents promises that Whoop won’t try to re-identify it.51411 Its 2020 privacy policy said Whoop used “technical measures and safeguards to help ensure that partners do not attempt to re-identify” data it shared; that sentence was gone by September 2021.158

Whoop’s own scientists describe how members agree. In a 2026 study of tobacco use among Whoop members, they wrote: “All members consented to the use of their deidentified data for research purposes at account creation under WHOOP’s Terms of Service.”16 For members in Europe and the UK, Whoop’s privacy policy gives the legal basis for research and development as the company’s “legitimate interests”; separately, it says it will ask for explicit consent to process health data that European law treats as a special category.5

The terms make the training license “subject to any applicable Account settings that you select.”11 We found no setting in Whoop’s documents that applies to it. We haven’t seen the app itself.

Other companies make different choices. Oura, a rival maker of health trackers, says in its privacy policy that it “may collect and use personal data to develop, test, improve, and support Oura’s own AI, machine learning, and large language model-powered features.”17 Samsung’s US privacy policy says it may use residents’ data “to develop and train our artificial intelligence algorithms and models,”18 and Fitbit’s says it uses the data it collects to “develop new features and Services, which may include generative artificial intelligence models.”19 Garmin uses members’ activity and health data for internal research and development only if they are “opted in to product improvement,” though it uses aggregated data to “develop or improve features and services” without one.20 Apple says: “Your private personal data is not used to train our foundational AI models.”21

What goes into the models

Whoop’s documents don’t say which kinds of data are used for training, but its job postings describe what the company wants to build. A listing for a vice-president of what Whoop calls Foundation AI, taken down in March, described “multimodal foundation models” that “unify wearable sensor data, language, blood biomarkers, clinical information, and self-reported inputs.”22

Whoop now holds more of that kind of data than it used to. Since 2025 it has sold blood tests through its Advanced Labs service, and members can upload results from other labs.237 Since June 2026, members in the US can connect their medical records through a company called HealthEx, bringing “clinical history - including diagnoses, medications, and procedures” into the app.2425 Connecting records is optional.25 The terms say the content the training license covers may include lab results; they don’t mention medical records.11

Whoop’s AI coach runs on a large language model from an outside partner, which Whoop’s privacy policy says has a “Zero-Retention/Zero Training Policy” and receives only de-identified data.5 OpenAI, which supplied the model when the coach launched in 2023,26 published a case study in 2024 saying that “after fine-tuning with anonymized member data and proprietary WHOOP algorithms, GPT-4 was able to deliver extremely personalized, relevant, and conversational responses.”27 The two statements are hard to square. The policy says the partner won’t use members’ metrics to train “any algorithms or LLM technology”; the case study describes fine-tuning GPT-4 on anonymized member data.527 They may describe different data or different periods.

The numbers behind the data

Whoop’s own figures for the size of its data don’t line up. On March 31 it said its insights were “powered by more than 24 billion hours of physiological data.”2 Seven months later, Ahmed said it had “just over 50 billion.”1 Adding 26 billion hours in those 212 days would take about 5.1 million people wearing a band every hour of every day. Whoop reported more than 2.5 million members in March and more than 3 million in July.228 Even if 4 million members had worn one around the clock for the whole period, the total would have reached about 44 billion hours. One of the two figures is out of date, counts something different or is wrong.

Ahmed didn’t say how the 23.6 hours a day was measured.1 Whoop’s research page gives a different measure, which it doesn’t define: “99.1% Data captured on active days.”29 The only published study of wear by Whoop’s scientists that we found measured days, not hours. It followed 11,914 members who joined in 2024 for their first 12 weeks; 36.5% wore the band every day.30 That study left out people who stopped wearing it, so it doesn’t describe all members.