WHOOP

Is WHOOP safe?

Reasonably, but it is not as private as its subscription model might suggest. WHOOP's screenless band records heart rate, sleep, strain, recovery, blood oxygen and blood pressure estimates, and all of it lives in the app. WHOOP's privacy policy, last updated in April 2026, says it does not sell personal data or health data. Its store listings show that some data is still used for marketing and shared with other companies.

We score WHOOP 64/100, below Oura at 76 and Garmin Connect at 70, and close to Fitbit at 66. The FDA dispute over blood pressure, which ended without a fine, weighs less than the everyday data practices.

Does WHOOP share your data?

Yes, more than most wearable apps we have scored. On Google Play, WHOOP lists name, email address, user IDs, approximate location, payment information, app interactions, installed apps, messages and crash logs as data shared with other companies. Email and approximate location are shared partly for advertising or marketing. Garmin and Oura list no sharing at all.

Apple's label shows nothing under "Data Used to Track You", but fitness data, coarse location, email address and ad data are used for WHOOP's own advertising or marketing. Health and fitness data and sensitive information are used for analytics.

The policy explains part of this. WHOOP works with advertising partners and social media companies to advertise its service, using cookies on its website. It also says it may receive data from "information services and data licensors" to supplement what it holds about you. Health-based personalisation, it says, stays inside WHOOP. De-identified wellness data is used for research with partners.

A proposed class action filed in 2025 by a user, Steven Lomeli, alleges that the app sent heart rate, blood oxygen, blood pressure, stress and sleep data, and fitness-video viewing, to the analytics company Segment without consent, nextpit reported. These are allegations. We found no ruling, so the suit does not change the score.

What happened with the FDA and blood pressure?

On 14 July 2025 the FDA's device centre sent WHOOP a warning letter. It said Blood Pressure Insights, which gave daily systolic and diastolic estimates, was a medical device sold without clearance, and that "providing blood pressure estimation is not a low-risk function". The letter said WHOOP had told the agency in May 2025 that it intended to keep selling the feature, and WHOOP publicly disagreed with the FDA.

In January 2026 the FDA updated its general wellness guidance. On 17 June 2026 it closed the matter, citing changes WHOOP had made to the feature and its labelling. The close-out covers only the modified feature.

We treat the letter as a regulator warning that names an app feature, without a fine or order, and closed after changes. That puts the regulatory record at 83. For users, the practical point is that WHOOP's blood pressure numbers are trend estimates, not readings to act on. A cuff or your doctor gives the figures that matter.

How secure is a WHOOP account?

We know less than we would like. The policy cites industry-standard encryption, regular cybersecurity assessments, disaster recovery testing and access controls. WHOOP publishes no audit or certification we could check, unlike Oura's yearly SOC 2 reports. WHOOP has run a public bug bounty on HackerOne since February 2025. It covers the iPhone and Android apps, the web app and the straps themselves, and pays $50 to $3,000. We found no reported breach of WHOOP user data.

WHOOP Coach, the AI assistant, runs on an outside large language model. WHOOP says the partner has a "zero-retention, zero-training" policy for your metrics, while WHOOP keeps your chat history until you delete it.

How to use WHOOP safely

1. Go to the app's privacy settings and make your profile private, so other members cannot find you by name.
2. Leave Teams you no longer train with, and check what you post through WHOOP Live before you share it.
3. Opt out of marketing emails in the WHOOP Privacy Center, and block ad cookies on WHOOP's website.
4. Delete WHOOP Coach chats that contain details you would not want stored.
5. Treat blood pressure and other health estimates as trends. See a doctor about any reading that worries you.

How we scored it

The regulatory record (83) is the strongest factor, because the FDA matter closed without a fine. Privacy (55) is the weakest, because WHOOP shares contact and location data with other companies for marketing despite a no-sale policy. Security (65) credits a paid bug bounty but loses points for the lack of any published audit. Scams and harmful content (72) is lowered by searchable profiles and a 13+ store rating for an adults-only service.