# Whoop's data figures and the history of its privacy policy and terms

Data and code for The Countersign's story "Whoop's terms, not its privacy
policy, let it train AI on members' data." The method is set
out in full on the story's data and method page.

Dates are yyyy-mm-dd, and blank means the value doesn't apply. Everything
was retrieved on November 4, 2026.

## Files

**whoop_figures.csv**: one row per figure Whoop or its chief executive has
published about its members, its data and its research, with the exact
wording.

| Column | Meaning |
|---|---|
| date | The date of the statement or publication. |
| figure | What the figure measures, for example members or hours_of_data. |
| value | The number, with words such as "over" or "about" removed. |
| unit | members, hours, usd, days, percent and so on. |
| qualifier | How the source qualified the number: exact, more_than, about, expected and so on. |
| exact_wording | The source's words, copied exactly. |
| source_id | Our id for the source (see "Sources" below). |
| speaker | Who made the statement. |
| note | Anything needed to read the row correctly. |

**figures_check.txt**: the arithmetic behind the story's section "The
numbers behind the data," written by check_figures.py from
whoop_figures.csv: whether the member counts agree with each other, what it
would take to go from 24 billion to 50 billion hours of data, and how the
wear-time figures compare.

**policy_history.csv**: one row per Internet Archive copy we analysed of
three Whoop documents: the full privacy policy (`privacy`), the legal
policies page with Whoop's privacy principles and consumer health data
notice (`hub`), and the terms of use (`terms`). We used one copy a month,
from the copies the Archive already held.

| Column | Meaning |
|---|---|
| document | privacy, hub or terms. |
| capture_timestamp | The Archive's timestamp for the copy (yyyymmddhhmmss, UTC). |
| capture_url | The copy, viewable at the Archive. |
| original_url | The address the Archive copied. |
| text_characters | Characters of visible text extracted from the copy. |
| last_updated | The "Last Updated" date printed on the document, if any. |
| document_text_present | True if the copy holds the document's text (some copies are empty pages, redirects or the site's loading shell). Copies marked False are not used. |
| the remaining columns | True if the copy's text contains the phrase listed below for that column, ignoring case. Blank where the column doesn't apply to that document. |

The phrase columns, and what each matches:

| Column | Document | Matches |
|---|---|---|
| research_and_development_clause | privacy | "research and development" |
| deidentified_data_for_research | privacy | "de-identified wellness data for research", "deidentified wellness data for research" or "for research purposes" |
| retain_deidentified_after_deletion | privacy | "derived from or incorporating your personal data" |
| whoop_coach_section | privacy | "whoop coach" |
| llm_partner_zero_training | privacy | "zero training" or "zero-training": the promise that the outside company whose model runs Whoop's AI coach won't train on members' data |
| consumer_health_data | privacy | "consumer health data" |
| advanced_labs | privacy | "advanced labs" |
| mentions_artificial_intelligence | privacy | "artificial intelligence" or " ai " |
| mentions_machine_learning | privacy, terms | "machine learning" |
| mentions_model_training | privacy, hub | "to train any", "train ai", "train models", "train our", "model training" or "foundation model": wording about Whoop training models itself. It doesn't match the coach partner's no-training promise ("for training any algorithms or LLM technology"); llm_partner_zero_training covers that. |
| does_not_sell | privacy | "we do not sell personal data", "we do not sell your", "whoop has not sold any" or "we never sell" |
| ccpa_sale_disclosed | privacy | "we sell your personal data", which the 2020 policy used in its California section, where "sell" has the law's broad meaning |
| hipaa_section | privacy | "hipaa" |
| personalization_setting | privacy | "personalization settings" |
| medical_records | privacy | "medical record" or "health record" |
| consumer_health_data_notice | hub | "consumer health data privacy notice" |
| chd_research_deidentified_or_aggregated | hub | "research and development to improve our services, in a de-identified or aggregated form" |
| chd_not_sold | hub | "we do not sell your consumer health data" |
| chd_marketing_consent_where_required | hub | "before using consumer health data for marketing" |
| principle_only_aggregated_or_deidentified | hub | "uses only aggregated or de-identified wellness data" |
| principle_never_sell | hub | "we never sell our members" |
| deidentified_no_longer_personal_data | hub | "de-identified data is no longer personal data" |
| ai_technology_defined | terms | "ai technology" |
| license_to_train_ai_models | terms | "to train any ai technology models" or "train any ai technology" |
| aggregate_and_deidentified | terms | "aggregate and deidentified", "aggregated and de-identified" or "aggregate and de-identified" |
| perpetual_license_to_your_content | terms | "perpetual, worldwide" |
| your_content_includes_lab_results | terms | "your content may include lab results" |
| arbitration_agreement | terms | "arbitrat" |

A phrase search can miss reworded text, and a copy can lack a section
because the page drew it with JavaScript the Archive didn't run. We read
the copies at every change the story reports. One copy needs a warning: the
terms copy of 2026-04-01 is headed "Last Updated: October 9, 2025" but
carries the older license, without the training clause, which every other
copy of that version has. We don't know why.

**policy_history_summary.txt**: for each phrase, the first copy that
contains it and the copy before it that doesn't, written by
policy_history.py.

**whoop-blog-post-2026-11-04.txt**, **whoop-blog-post-date-2026-11-04.png**
and **whoop-blog-post-faq-2026-11-04.png**: our copy of Whoop's blog post
"How WHOOP AI guidance turns your health data into personalized coaching,"
as it appeared on November 4, 2026, with screenshots of its date and of
the answer saying Whoop "uses anonymized member data for AI model
training." The Internet Archive holds no copy of this version, so we
publish ours. These are Whoop's words and images, so they aren't in
data.zip or under our license.

**readme.md**: this file.

**data.zip**: the files above in one download.

**code.zip**: the scripts that produced them, with this readme:
check_figures.py, policy_history.py and package.py, which builds this
package.

## Sources

source_id in whoop_figures.csv refers to these. Ids the story cites appear
in its source list with the same id in lower case.

| Id | Source |
|---|---|
| POD-01 | All-In Podcast, "WHOOP CEO, Will Ahmed: 50B Hours of Health Data, a 4 Million Member Data Moat, & the FDA Fight", 2026-10-29. https://www.youtube.com/watch?v=Uc6xXNBWjfc |
| PR-01 | Whoop, "WHOOP Raises $575 Million at $10.1 Billion Valuation to Advance Global Health Platform", Business Wire, 2026-03-31. https://www.businesswire.com/news/home/20260331399622/en/ |
| PR-02 | Whoop, "WHOOP Expands Health Platform with On-Demand Clinician Access and New AI Features", Business Wire, 2026-05-08. https://www.businesswire.com/news/home/20260508464188/en/ |
| PR-03 | Whoop and HealthEx, "WHOOP and HealthEx Partner to Connect Medical Records and Biometric Data to Deliver More Personalized Health Insights", Business Wire, 2026-06-17. https://www.businesswire.com/news/home/20260617800663/en/ |
| REL-01 | Whoop, "WHOOP Names Dirk-Jan "DJ" van Hameren Chief Marketing Officer as Member Base Surpasses 3 Million", 2026-07-08 (copy on Medianet). https://newshub.medianet.com.au/2026/07/whoop-names-dirk-jan-dj-van-hameren-chief-marketing-officer-as-member-base-surpasses-3-million/161167/ |
| REL-02 | Whoop, "WHOOP Launches Clinician-Reviewed Advanced Labs, Unlocking a Comprehensive View of Human Health", 2025-09-30 (copy in the Quest Diagnostics newsroom). https://newsroom.questdiagnostics.com/2025-09-30-WHOOP-Launches-Clinician-Reviewed-Advanced-Labs,-Unlocking-a-Comprehensive-View-of-Human-Health |
| REL-03 | Whoop, "WHOOP Unveils the New WHOOP Coach Powered by OpenAI, the First Wearable to Deliver Highly Individualized Performance Coaching on Demand", Business Wire, 2023-09-26. https://www.businesswire.com/news/home/20230926899032/en |
| RES-01 | Grosicki and others, "Wearing WHOOP More Frequently Is Associated with Better Biometrics and Healthier Sleep and Activity Patterns", Sensors 25(8):2437, 2025-04-12. https://doi.org/10.3390/s25082437 |
| WHOOP-06 | Whoop, "Research" page, as of November 4, 2026. https://www.whoop.com/us/en/research/ |
| INV-01 | Craig Shapiro, "WHOOP", Collaborative Fund blog, 2026-03-31. https://collabfund.com/blog/whoop/ |
| SEC-02 | Whoop, Inc., Form D filed with the SEC on 2020-11-12. https://www.sec.gov/Archives/edgar/data/1582746/000158274620000001/primary_doc.xml |

## Rerunning

You need Python 3 and nothing else. From a folder holding the scripts,
with whoop_figures.csv in a data/ folder beside them as the scripts expect
(see the paths at the top of each script):

1. `python3 -I data/check_figures.py` rewrites figures_check.txt from
   whoop_figures.csv.
2. `python3 -I data/policy_history.py` lists the Archive's copies, downloads
   one a month for each document (read-only: it never asks the Archive to
   make new copies) and rewrites policy_history.csv and
   policy_history_summary.txt. It takes several minutes and saves the copies
   in data/raw/ia/. `--offline` reanalyses copies already saved.

The Archive holds no usable copy of the current privacy policy (dated
August 3, 2026), so the story relies on our own copy, retrieved on
November 4, 2026, for that version.

## Licenses

- **The code** is under the MIT license (LICENSE-code.txt).
- **Our data files** are under Creative Commons Attribution 4.0
  (LICENSE-data.txt): reuse them freely, crediting The Countersign.
- **Whoop's own words**, quoted in the files, and the copy of its blog
  post remain Whoop's.