Pursuant to the Washington My Health My Data Act and the Nevada Consumer Health Privacy Law (together the “Health Privacy Laws”), the Marriott Group (“Marriott” or “We”) is providing the following details regarding the categories of Consumer Health Data that we collect, use, and share about Washington and Nevada residents. This Washington and Nevada Consumer Health Data Privacy Statement (the “Health Data Privacy Statement”) supplements the Marriott Group Global Privacy Statement (“Global Privacy Statement”).

CONSUMER HEALTH DATA
 

For purposes of this Health Data Privacy Statement, “Consumer Health Data” is a subset of Personal Data (as defined in the Global Privacy Statement) and extends further to mean Personal Data that is linked or reasonably linkable to a consumer and that identifies the consumer's past, present, or future physical or mental health status.

CONSUMER HEALTH DATA WE COLLECT, USE, AND SHARE

The Consumer Health Data we may collect from you will depend on the context of your interactions with Marriott.

Examples of Consumer Health Data include:

• In connection with providing our spa services, we may request information from you regarding various health conditions, or indication of pregnancy, as needed to safely provide spa services.
• In connection with responding to or submitting a personal injury claim, we may collect information regarding your health conditions, surgeries, procedures, medications, or other interventions.

As described above and further in ‘The Data We Collect’ section of the Global Privacy Statement, we collect Consumer Health Data directly from you. We may also receive Consumer Health Data about you from third parties with your authorization.

USE OF CONSUMER HEALTH DATA

Marriott collects, uses, and shares the Consumer Health Data listed above with your consent, or as reasonably necessary to provide you with services you have requested or authorized.  We may use and share Consumer Health Data to operate, manage, and maintain our business, to provide our services, and to accomplish our business purposes and objectives, including, for example, to undertake quality and safety assurance measures; conduct internal investigations; comply with law, legal process, and internal policies; maintain records; and exercise and defend legal claims.  

We may also use and share Consumer Health Data with a third party in the context of any reorganization, financing transaction, merger, sale, joint venture, partnership, assignment, transfer, or other disposition of all or any portion of our business, assets, or stock (including in connection with any bankruptcy or similar proceedings).

We may share Consumer Health Data with the following categories of third parties:

• Our Affiliates. We may enable access to Consumer Health Data across our subsidiaries, affiliates, and related companies, for example, where we share common data systems or where access helps us to provide our services and operate our business. A full list of our affiliates can be found here.
• Service Providers. We may share Consumer Health Data with vendors or processors working on our behalf for the purposes described above; for example, with providers that host our spa scheduling software and our claims database.
  
• Governmental Agencies. We may disclose Consumer Health Data to law enforcement or other government agencies when we believe doing so is necessary to comply with applicable law or respond to valid legal process.
  
• Other Third Parties. In certain circumstances, it may be necessary to provide Consumer Health Data to other third parties, for example, to comply with the law or to protect our rights or those of our customers, or in connection with a corporate transaction.
  

We do not “sell” Consumer Health Data, as defined in the Health Privacy Laws. We do not permit third parties to collect Consumer Health Data over time and across different internet websites or online services on our Online Services. For more information about our Online Services, please see the Global Privacy Statement.

INDIVIDUAL RIGHTS

Overview of Individual Rights

If you are a Washington or Nevada resident, you may have the right to submit some or all of the following requests regarding your Consumer Health Data, subject to applicable law and certain exceptions:

• Request to Know. You may request that we disclose whether we are collecting, sharing, or selling your Consumer Health Data, as well as a list of third parties with whom your Consumer Health Data is shared or sold. You may request that we provide you with a copy of the Consumer Health Data that we hold about you.
• Request to Correct. You may request that we make changes to your Consumer Health Data.
  
• Request to Delete. You may request that we delete your Consumer Health Data. If you make a Request to Delete, we may ask you to confirm your request before we delete your Consumer Health Data.
  
• Request to Withdraw Consent. You may request to opt-out of the collection or sharing of your Consumer Health Data.
  
• Request to Appeal. If your request was denied, you may appeal our decision within a reasonable period after receiving a denial notice.
  

How You Can Exercise Your Rights

To make a Request to Know, Correct, Delete, or Opt-Out, please contact us via our Individual Rights secure Portal here↗ or call 1-800-218-9316. For your protection, we may request additional information from you in order to verify your identity, such as your name, email address, postal address, phone number, and/or loyalty number, and will use that information to match with information we already have. We will respond to your request consistent with applicable law.

If your request to exercise a right under the Health Privacy Laws is denied, you may appeal the denial by contacting us at privacy@marriott.com or calling 1-800-218-9316. 

For residents of Washington, if your appeal is unsuccessful, you can raise a concern or lodge a complaint with the Washington State Attorney General at www.atg.wa.gov/file-complaint↗.

For residents of Nevada, if your appeal is unsuccessful, you can raise a concern or lodge a complaint with the Nevada State Attorney General at https://ag.nv.gov/Complaints/File_Complaint/↗.

CHANGES TO THIS HEALTH DATA PRIVACY STATEMENT

We may change or update this Health Data Privacy Statement from time to time. When we do, we will post the revised version on this page with a new “Last Updated” date.

CONTACT US

If you have questions or concerns about this Health Data Privacy Statement, you may contact us at privacy@marriott.com, or by mail:

Marriott International, Inc.
Global Compliance, Privacy
7750 Wisconsin Avenue
Bethesda, MD 20814