Notice extends the Starbucks Privacy Notice for consumer health data
This notice is an add-on to the main Starbucks Privacy Notice, not a standalone replacement. It covers only personal information that counts as "consumer health data" under the Washington State My Health My Data Act and the Nevada Consumer Health Data Privacy Bill. Information that falls outside those two laws' definition is left to the main Privacy Notice.
Supporting quotations
This notice acts as an extension to the Starbucks Privacy Notice and applies to personal information defined as “consumer health data” subject to the Washington State My Health My Data Act and the Nevada Consumer Health Data Privacy Bill.
Qualifications & exceptions
Applies only to personal information defined as consumer health data under the two named laws.
Described as an extension of the Starbucks Privacy Notice, so the two documents work together.
Not stated here
The text of the Starbucks Privacy Notice is not part of this saved document, so how the two documents fit together in detail is not shown here.
The notice does not say which laws' definitions decide what counts as consumer health data beyond naming the two laws.
The notice does not say who is covered beyond referring to the two states' laws, such as whether residence in Washington or Nevada is required.
Data Access & Collection · Company practice
Health information can arrive through a customer event report
Starbucks says only a small part of the personal information it collects may count as consumer health data under these laws. The example it gives is a customer event report: if you report an event related to your health that resulted from an experience at Starbucks, the information you provide may be consumer health data. The notice says "may" in both places, so it does not say every report is consumer health data or that no other information could qualify.
Supporting quotations
A small portion of the personal information we collect may be considered consumer health data under these laws.
If you report an event related to your health as a result of an experience at Starbucks (“customer event report”), you may provide personal information that may be considered consumer health data.
Qualifications & exceptions
Described as a small portion of the information Starbucks collects.
The example is a report of a health-related event resulting from an experience at Starbucks.
The wording is "may be considered", not a statement that the information always is.
Not stated here
The notice does not list what kinds of health information a customer event report may contain.
The notice does not say where or how a customer event report is submitted.
The notice does not say whether the customer event report is the only way health-related information reaches Starbucks, only that it is the example given.
Data Access & Collection · Company commitment
Starbucks says it does not collect health data from other sources
Starbucks states that it does not collect consumer health data from other sources. Read together with the customer event report example, the notice presents your own report as the way Starbucks gets this kind of data. "Other sources" is not defined, so the notice does not name which sources are excluded.
Supporting quotations
We do not collect consumer health data from other sources.
Qualifications & exceptions
The statement is about consumer health data, not about all personal information.
Not stated here
"Other sources" is not defined, so the notice does not list which sources are excluded.
The statement is made in this notice about consumer health data; the main Starbucks Privacy Notice, which is not supplied here, may describe other sources for other personal information.
Use & Processing · Company practice
Event report health data is used with your consent for three purposes
With your consent, Starbucks will use the consumer health data you provide in a customer event report for three stated purposes: to resolve the event, to communicate with you, and to comply with applicable laws. The notice makes consent the condition for this use. The broader description of how Starbucks uses personal information is in a linked section of the Starbucks Privacy Notice, which is not part of this document.
Supporting quotations
With your consent, we will use the consumer health data provided as part of a customer event report to resolve the event, to communicate with you, and to comply with applicable laws.
Qualifications & exceptions
Use is stated to be "with your consent".
The three purposes are resolving the event, communicating with you and complying with applicable laws.
Applies to consumer health data provided as part of a customer event report.
Not stated here
The notice does not say how or when consent is requested or recorded.
The linked section on how Starbucks uses personal information is not supplied in this saved document, so uses of other information are not shown here.
The notice does not say whether the stated purposes are the only permitted uses of this data.
Sharing & Disclosure · Permission or license
Event reports with health data may be shared with service providers
Starbucks may share customer event reports that contain consumer health data with third party service providers, either to help resolve the event or as required by law. This is a statement of permission ("may"), not a promise that every report is shared. Unlike the use statement, this sentence does not mention consent. The notice sends readers to the Starbucks Privacy Notice for how personal information may be disclosed more generally.
Supporting quotations
We may share customer event reports that contain consumer health data with third party service providers to facilitate the resolution of the event or as required by law.
Qualifications & exceptions
Wording is "may share", not a commitment to share every report.
Recipients named are third party service providers.
Stated reasons are to facilitate resolution of the event or as required by law.
Not stated here
The notice does not name the service providers or describe their categories.
The sentence does not say whether sharing with service providers depends on your consent; consent is mentioned only for use.
The phrase "as required by law" could attach to sharing with service providers or stand as a second reason for sharing; the sentence does not make clear which recipients it covers.
The linked section of the Starbucks Privacy Notice on disclosure is not supplied in this saved document.
Account & Service Control · User right or choice
Rights to access, delete or withdraw consent, subject to exceptions
The notice says the two laws give you certain rights over consumer health data, including rights to access it, delete it, or withdraw your consent relating to it. These rights are stated to be "subject to certain exceptions", but the notice does not say what the exceptions are. "Including" signals the list may not be complete.
Supporting quotations
These laws provide certain rights with respect to consumer health data, including rights to access, delete, or withdraw consent relating to such data, subject to certain exceptions.
Qualifications & exceptions
Rights are described as coming from the laws, and the list is introduced with "including".
Rights are "subject to certain exceptions".
Not stated here
The exceptions are not described in this notice.
The notice does not list any rights beyond access, deletion and withdrawal of consent.
The notice does not say how quickly Starbucks responds to a request.
Account & Service Control · Procedure
Rights requests go through a linked privacy web form
To exercise these rights you submit a request through a linked form, labelled "HERE" in the notice. The notice names no other method for making a request in this section.
Supporting quotations
If you want to exercise your rights under these laws, submit
Qualifications & exceptions
The only method named in this section is the linked web form.
Not stated here
The linked form is not part of this saved document, so what it asks for is not shown here.
The notice does not say whether identity checks apply or how long a response takes.
Legal Rights & Agreement Rules · User right or choice
Denied requests can be appealed, then taken to a state attorney general
If Starbucks denies your request to exercise a right, you may appeal by contacting Starbucks at the privacy email address given in the notice. If the appeal is unsuccessful, you can raise a concern or lodge a complaint with the Washington State Attorney General or the Office of the Attorney General for Nevada, using the website addresses shown in the notice.
Supporting quotations
If your request to exercise a right is denied, you may appeal that decision by contacting us at
If your appeal is unsuccessful, you can raise a concern or lodge a complaint with the Washington State Attorney General at
or the Office of the Attorney General for Nevada at
Qualifications & exceptions
The appeal step applies when a request to exercise a right is denied.
The attorney general step applies when the appeal is unsuccessful.
Washington and Nevada each have their own attorney general office named.
Not stated here
The notice does not give a deadline for appealing or a time limit for Starbucks to decide an appeal.
The notice does not say which attorney general applies to which person, for example by state of residence.