Washington Consumer Health Data Privacy Policy

This Washington Health Data Privacy Policy supplements the Nordstrom Privacy Policy and applies to personal data defined as "Consumer Health Data" subject to the Washington State My Health My Data Act, which Nordstrom collects from customers using our spa services in Washington ("Spa Services") for the limited purposes described below.

Consumer Health Data We Collect

You may provide us with certain Consumer Health Data including information about your health-related conditions (e.g., pregnancy or hypertension), symptoms (e.g., back pain), status, diagnoses (e.g., allergies), testing or treatments (e.g., skin care medications), surgeries, procedures, medications or other interventions through intake forms you complete or that you otherwise communicate to us in order for us to deliver the Spa Services you request. Please note that whether you received Spa Services, by itself, is not considered Consumer Health Data.

Sources of Consumer Health Data

As noted above, personal data (which may also be Consumer Health Data) is collected directly from you through intake forms or other ways you communicate this information to our Spa Services team.

Why We Collect & Use Consumer Health Data

We collect and use Consumer Health Data to provide requested Spa Services as safely as possible. For example, knowing what allergies you have or skin medications you take can help our spa professionals select products that are less likely to cause you skin issues. Similarly, learning about conditions and physical pain you experience will help our spa professionals to provide a massage more tailored to your needs. See How to Exercise Your Rights, below, for more details on the controls and choices you may have associated with your Consumer Health Data.

When We Share Consumer Health Data

We may share any of the categories of Consumer Health Data we collect, described above, as reasonably necessary to safely provide Spa Services you have requested or authorized.

We may also disclose data when we believe that doing so is necessary to comply with applicable law, respond to valid legal process, or to defend the rights of Nordstrom or others.

Categories of Those with Whom We Share Consumer Health Data

In order to deliver products and services to you as a Nordstrom spa customer, for the purposes described above, we share Consumer Health Data with the following categories of third parties:

• Nordstrom family of brands and companies, including our affiliates, parents and subsidiaries to enable access to data across our subsidiaries, affiliates, and related companies, for example, where we share common data systems or where access helps us to provide our services and operate our business.
  
  
• Parties to business transactions, including those involved in strategic business transactions like mergers, acquisitions, joint ventures, asset sales, reorganizations, divestitures, dissolutions, bankruptcies, liquidations, or other types of strategic business transactions. We may disclose Consumer Health Data as part of a corporate transaction or proceeding such as a merger, financing, acquisition, bankruptcy, dissolution, or a transfer, divestiture, or sale of all or a portion of our business or assets.
  
  
• Others not otherwise described above, including processors who assist us in storing records, preventing harm or fraud to us or you; law enforcement, government entities, courts, or other third parties as required or allowed by applicable law, such as for legal and safety purposes.

How to Exercise Your Rights

As a customer of Spa Services in Washington, you have certain rights with respect to your Consumer Health Data, including the right to request access or deletion of that data. The rights granted to you under applicable law may, however, provide us with exceptions to fulfilling your request, including where we need to retain the information for a purpose permitted by applicable law.

You can request to exercise your right to access or deletion associated with your Consumer Health Data by using our online form or by emailing privacy@nordstrom.com and indicating which right you are exercising. Please include "Exercising Consumer Health Data Right" in the subject line of your request to enable us to properly process the request.

Should you wish to appeal a determination we have made with regard to your Consumer Health Data, send an email to privacy@nordstrom.com within 14 days of receiving a final response from us. Include "Consumer Health Data Rights Appeal" in the subject line of your email, and provide your name, the email address associated with your request and any relevant information for us to investigate your appeal. We will provide a response to your request for an appeal within a reasonable time and in accordance with applicable law. If your appeal is unsuccessful, you can raise a concern or lodge a complaint with the Washington State Attorney General at atg.wa.gov/file-complaint.