DISCLAIMER.md

Rama main · réplica de lectura del repositorio original.

# Wellness and legal disclaimer

WHOOP Personal MCP is an independent, open-source personal wellness tool. It
retrieves read-only data from a WHOOP account and computes summaries that an AI
client may use in a conversation.

## Not medical advice

The software, its computed metrics, and any AI response that uses them are for
general informational and wellness purposes only. They are not medical advice,
a diagnosis, treatment, a medical device, or a substitute for a qualified
health professional. Metrics such as the experimental Day Strain ratio,
recovery trends, sleep debt, and target-event context are simplified estimates.
They have not been clinically validated for your circumstances and can be
incomplete, stale, or wrong.

Do not use this project to make emergency, medication, diagnosis, return-to-play,
or other high-stakes health decisions. If you may be experiencing an emergency,
contact local emergency services. Ask an appropriate clinician about symptoms,
injury, pregnancy, a medical condition, or a material change to training.

AI systems can misread accurate data, invent facts, or give unsafe advice.
Review the underlying dates and values, keep a human in control, and stop an
activity if it feels unsafe.

## Personal, single-user scope

One deployment is designed for one person and one linked WHOOP account. The
same owner may connect more than one trusted MCP client. Do not use one instance
for multiple people, a team, patients, research participants, employees, or
customers. It has no tenant isolation, role-based access control, clinical
audit trail, or regulated records workflow.

## WHOOP API terms and owner consent

Using the software does not grant rights to use the WHOOP APIs or data outside
WHOOP's current terms. Each operator must review and comply with the
[WHOOP API Terms of Use](https://developer.whoop.com/api-terms-of-use/), create
their own personal Developer app, keep its credentials confidential, and obtain
the owner's express authorization before accessing data. Before sending a tool
result to an MCP client or AI provider, the owner must also explicitly opt in to
that disclosure and understand the destination/provider.

The current server requests limited read scopes, uses HTTPS for remote
deployments, and does not persist WHOOP API responses or tool results. Those
design choices do not ensure that every operator, host, client, model provider,
or downstream use complies with the WHOOP terms. The terms contain additional
requirements and restrictions, including for credentials, security incidents,
third-party disclosure, permanent copies/caching, branding, and termination.
They can change. Operators must disconnect/revoke access and delete applicable
local and downstream copies when their use terminates.

## HIPAA and other health privacy laws

This project is not represented as HIPAA compliant and is not offered for use
by HIPAA covered entities or business associates. The maintainers do not offer
a Business Associate Agreement. Do not use it to create, receive, maintain, or
transmit protected health information for a covered entity or business
associate.

WHOOP's current API Terms state that, unless WHOOP agrees otherwise in writing,
WHOOP does not represent that its APIs satisfy HIPAA obligations. They also say
a covered entity or business associate must not use the APIs in a way that
transmits PHI without WHOOP's prior written consent. That contractual condition
does not make this project HIPAA compliant, does not replace the operator's own
legal/security analysis, and does not authorize covered-entity use of this
project.

Whether HIPAA applies is contextual: it depends on who is using the software,
the relationships between the parties, the data, and the purpose. Fitness or
health-related data is not automatically covered by HIPAA, and being outside
HIPAA does not mean no law applies. Depending on the operator and use, the FTC
Act, the FTC Health Breach Notification Rule, state consumer-health privacy
laws, data-breach laws, contracts, and other requirements may apply. See the
[FTC's health privacy guidance](https://www.ftc.gov/business-guidance/resources/collecting-using-or-sharing-consumer-health-information-look-hipaa-ftc-act-health-breach).

This file is general information, not legal advice. It cannot determine your
obligations or eliminate liability. Consult qualified legal and security
professionals before any organizational, commercial, research, employment, or
regulated use.

## No warranty; limitation of liability

The project is provided under the MIT License, including its no-warranty and
limitation-of-liability terms. To the fullest extent permitted by applicable
law, use is at your own risk. Some jurisdictions do not allow every warranty
disclaimer or liability limitation, so the license and this notice may not
exclude all responsibility in every situation.

Support for an MCP protocol revision is a technical interoperability claim, not
a certification by the MCP project, Anthropic, xAI, OpenAI, another client
vendor, WHOOP, or a regulator. Client vendors can change protocol, OAuth,
retention, and product behavior independently. Test the exact client version and
deployment you intend to use; compatibility does not establish security,
fitness for a particular purpose, legal compliance, or medical correctness.

## Independence and trademarks

This project is not affiliated with, endorsed by, or sponsored by WHOOP, xAI,
Anthropic, OpenAI, OpenClaw, Railway, or any other client or hosting provider.
Names and trademarks belong to their respective owners.

Read [PRIVACY.md](PRIVACY.md) before connecting an AI client and
[SECURITY.md](SECURITY.md) before exposing the server to the internet.