Privacy policy
WHOOP Relay · last updated 2026-09-11
WHOOP Relay lets you use your own WHOOP data inside Claude. This page says exactly what we store, why, for how long, and how to make it go away.
Who is responsible
PromptMetrics, Berlin, Germany operates WHOOP Relay and is the data controller for the processing described here. Contact: privacy@promptmetrics.dev. WHOOP, Inc. is the source of the data and a separate controller for what happens inside the WHOOP app and the WHOOP developer platform; WHOOP's own policy governs that.
What we collect
Only what you authorise on the WHOOP consent screen, fetched through the official WHOOP Developer API (v2):
| Category | Fields | Why |
|---|---|---|
| Profile | WHOOP user id, first and last name, email | Identify your connection; the invite check; support |
| Body measurements | Height, weight, max heart rate | Shown on request in your profile |
| Recovery | Recovery score, HRV, resting heart rate, SpO₂, skin temperature | Answer questions, draw the dashboard |
| Sleep | Sleep and nap times, stage durations, performance, respiratory rate | Same |
| Physiological cycles | Day strain, energy, average and max heart rate | Same |
| Workouts | Sport, times, strain, energy, heart-rate zones | Same |
| Technical | Webhook delivery ids, sync timestamps, OAuth tokens | Keep the copy current; de-duplicate; authenticate |
We store the WHOOP API records as received so that a future change in what we display never requires re-downloading your history. We do not collect location, raw heart-rate streams, or anything WHOOP does not expose through the fields above.
Access requests. Connecting without an invite creates an access request holding your name, email and WHOOP user id only. The WHOOP access you granted is revoked in the same moment and no health data is fetched. Denied requests are deleted after 30 days; approved ones are kept as the record of your invitation.
Why, and on what legal basis
Health and biometric data is special-category data under GDPR Article 9. We process it only on your explicit consent (Art. 6(1)(a) and 9(2)(a)), given when you approve WHOOP Relay on WHOOP's consent screen. The sole purpose is to show you your data: through the Claude client you connected and through the authenticated dashboard. There is no profiling, no advertising, no analytics on your health data, and no automated decision-making.
Who can see it
- You, in your Claude client and in the dashboard after WHOOP login.
- Anthropic receives whatever tool results you ask Claude to fetch, under your own Anthropic account terms. WHOOP Relay never pushes data to Anthropic on its own.
- Cloudflare hosts the service (Workers, D1 database, Durable Objects, Queues) as our processor under Cloudflare's data processing addendum. Data is encrypted in transit (TLS) and at rest by Cloudflare; OAuth tokens are additionally encrypted by us before storage.
- WHOOP sees the API requests we make on your behalf, as any connected app would.
No other user of WHOOP Relay can see your data: every request is tied to the account that authenticated it, and there are no share links. We never sell, license, rent or otherwise trade WHOOP data, and we do not use it to train any model.
Where
Cloudflare's network is global; the database and per-user storage may be processed outside the European Union. Transfers rely on Cloudflare's Standard Contractual Clauses and its EU–US Data Privacy Framework certification.
How long
For as long as your connection is active. Disconnecting deletes all of it in a single operation: every stored record, the OAuth tokens, and the connector authorisation. Disconnect from the dashboard button, with the disconnect_whoop tool in Claude, or by revoking "WHOOP Relay" in the WHOOP app (we detect that within 24 hours and delete just the same). Webhook delivery ids without personal content are pruned after 30 days. Server logs are kept by Cloudflare for at most 7 days. If WHOOP Relay shuts down, all data is deleted.
Your rights
Under GDPR you can access, correct, export, restrict or delete your data and withdraw consent at any time; withdrawing consent is exactly what disconnecting does. For anything you cannot do yourself, email privacy@promptmetrics.dev; we answer within 30 days. You may also complain to the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit).
Security incidents
If your data is affected by a breach we notify you and WHOOP without undue delay and, where required, the supervisory authority within 72 hours.
Changes
Changes are posted here with a new date. Material changes are announced on the landing page before they take effect.