MARSHMALLOO CONSUMER HEALTH DATA PRIVACY POLICY
Effective Date: September 6, 2026
Last Updated: September 6, 2026
This Consumer Health Data Privacy Policy ("Consumer Health Data Policy") describes how Marshmalloo LLC ("Marshmalloo," "we," "us," or "our") collects, uses, processes, discloses, protects, and responds to requests concerning information that may constitute "consumer health data" under applicable law ("Consumer Health Data").
This Consumer Health Data Policy is separate from and supplements our general Privacy Policy. It applies only to information that constitutes Consumer Health Data under applicable law.
Marshmalloo sells pillows, pillowcases, comforters, bedding, sleep products, and related accessories. Marshmalloo is not a healthcare provider, medical provider, health insurer, pharmacy, or medical-device provider. Our products, product recommendations, website content, customer-service communications, and other Services are not intended to diagnose, treat, cure, mitigate, or prevent any disease or medical condition and are not a substitute for professional medical advice.
1. WHAT IS CONSUMER HEALTH DATA?
Consumer Health Data means personal information that is linked or reasonably linkable to an individual and that identifies, reveals, reflects, or may reasonably be used to infer information concerning that individual's past, present, or future physical or mental health status, where such information is regulated as Consumer Health Data under applicable law.
Depending on the jurisdiction and circumstances, Consumer Health Data may include information concerning:
- a health condition, disease, diagnosis, injury, or disability;
- physical discomfort, pain, soreness, pressure sensitivity, or mobility limitations;
- symptoms, bodily functions, vital signs, or measurements;
- medical, behavioral, psychological, or other health-related interventions;
- surgeries or health-related procedures;
- medications or treatments;
- allergies or sensitivities;
- sleep-related information where it reveals or is used to identify a health condition or health status;
- reproductive or sexual health information;
- genetic or biometric information associated with health status;
- precise geolocation information used to identify or infer an attempt to obtain health-related services or products;
- health-related inferences derived from other information; or
- other information treated as Consumer Health Data under applicable law.
Not every statement concerning sleep, comfort, pillow firmness or loft, sleeping position, temperature preference, product preference, or purchase of a pillow, pillowcase, comforter, or bedding product constitutes Consumer Health Data. Whether information qualifies depends upon its content, context, use, and applicable law.
2. CONSUMER HEALTH DATA MARSHMALLOO MAY RECEIVE
Marshmalloo does not require medical diagnoses, diseases, injuries, treatments, or medications to purchase ordinary products. Consumers may nevertheless voluntarily disclose health-related information when communicating with Marshmalloo.
A. Health Conditions, Symptoms, or Physical Concerns
Depending on what you choose to tell us, we may receive information concerning back, neck, shoulder, hip, joint, or other physical discomfort; pain or soreness; physical injuries; health conditions or diagnoses; mobility or positioning concerns; pressure sensitivity; physical symptoms; allergies or sensitivities; or other physical or health-related concerns relevant to a question you ask us.
B. Treatment, Procedure, or Medication Information
If you voluntarily provide it, we may receive information concerning surgery, medical procedures, treatment, medication, recovery from an injury or procedure, or other health-related care. Marshmalloo does not ordinarily request this information.
C. Sleep-Related Health Information
You may voluntarily describe sleep-related concerns that identify or reveal information concerning your physical or mental health. Ordinary product preferences such as sleeping position, preferred pillow firmness or loft, whether you sleep warm, desired cooling, or desired pillow feel are not treated by Marshmalloo as Consumer Health Data unless their content or use makes them Consumer Health Data under applicable law.
D. Health-Related Information Contained in Communications
Consumer Health Data may be included in communications with customer-service representatives, product specialists, sales representatives, warranty or return personnel, telephone support, email, live chat, AI-enabled customer-assistance tools, contact forms, or other communications you initiate with Marshmalloo.
If you voluntarily include health-related information in a public review, testimonial, social-media submission, or other User Content, that information may become public. We do not require consumers to disclose medical information in reviews, and we encourage you not to include sensitive medical details in content intended for public display.
E. Other Voluntarily Provided Health-Related Information
A consumer may voluntarily include other health-related information in a communication even though Marshmalloo did not request it. We do not encourage consumers to provide medical information that is not reasonably necessary for their request.
F. Limited Health-Related Inferences
Where necessary to respond to a request you make, we may make a limited inference from Consumer Health Data you voluntarily provide. Marshmalloo does not intentionally create health-condition profiles about customers for advertising purposes.
3. CONSUMER HEALTH DATA WE DO NOT INTENTIONALLY SEEK
Through our ordinary consumer Services, Marshmalloo does not intentionally seek medical records, detailed medical histories, medical test results, genetic information, biometric information used to identify health status, reproductive or sexual health information, information concerning gender-affirming care, precise geolocation for determining whether a consumer sought health care, or similar highly sensitive medical information.
If you voluntarily include such information in a communication to Marshmalloo, we will treat it in accordance with this Policy and applicable law.
Marshmalloo does not intentionally infer a consumer's health status merely from the consumer's purchase, browsing activity, product views, or ordinary shopping behavior.
4. SOURCES OF CONSUMER HEALTH DATA
Directly From You
This is the primary source. You may voluntarily disclose health-related information when you call customer service, communicate through chat, send an email, request product-selection assistance, submit a warranty or return inquiry, communicate with an AI-enabled customer-assistance feature, complete a contact form, or otherwise ask Marshmalloo for assistance.
From a Person Acting at Your Direction
We may receive Consumer Health Data from another person where that person communicates with us at your direction or on your behalf.
From Service Providers Acting on Our Behalf
A service provider operating a communication or customer-service system on our behalf may transmit to Marshmalloo information that you voluntarily provided through that system.
From Limited Inferences
We may derive limited health-related information where reasonably necessary to provide a response, product, or service you requested.
Marshmalloo does not intentionally purchase Consumer Health Data from data brokers for advertising or profiling purposes.
5. WHY WE COLLECT AND USE CONSUMER HEALTH DATA
Marshmalloo limits its collection and use of Consumer Health Data to purposes permitted by applicable law.
A. Providing a Product or Service You Request
- responding to a question you ask;
- helping you select a pillow, pillowcase, comforter, bedding product, or other Marshmalloo product;
- responding to a comfort or product-suitability question;
- providing customer service;
- processing a return or exchange;
- administering a warranty;
- responding to a complaint or request; or
- otherwise providing a product or service you requested.
B. Customer-Service Administration
Where reasonably necessary, we may process Consumer Health Data contained in customer-service records to respond to your communication, maintain continuity in a customer-service matter, resolve a dispute, document a return or warranty matter, or administer our relationship with you.
C. Processing Based on Consent
Where applicable law requires affirmative consent for collection, use, or processing beyond what is necessary to provide a product or service you requested, Marshmalloo will seek the consent required by applicable law before engaging in that activity.
D. Security, Fraud Prevention, and Protection of Rights
Where permitted by law, Consumer Health Data may be processed as reasonably necessary to detect or prevent fraud; protect against security incidents; investigate malicious, deceptive, fraudulent, or unlawful activity; protect our systems and Services; comply with applicable law; respond to legally valid requests; or establish, exercise, or defend legal claims.
6. HOW WE DO NOT USE CONSUMER HEALTH DATA
Marshmalloo does not intentionally use Consumer Health Data to:
- create targeted-advertising audiences;
- engage in cross-context behavioral advertising based on a person's health condition;
- personalize third-party advertisements based upon a medical condition, diagnosis, symptom, injury, treatment, or other Consumer Health Data;
- build health-related advertising profiles;
- determine eligibility for employment, credit, insurance, housing, healthcare, or other similarly significant decisions;
- discriminate unlawfully against a consumer;
- train a general-purpose large language model using identifiable Consumer Health Data; or
- otherwise monetize Consumer Health Data in a manner prohibited by applicable law.
General website activity that does not identify or reveal a consumer's health status may be processed separately as described in our general Privacy Policy.
7. HOW CONSUMER HEALTH DATA IS PROCESSED
Consumer Health Data may be processed electronically through systems used to provide customer service, communications, requested product assistance, warranty or return administration, or related Services.
Depending on the interaction, processing may involve receiving the information you voluntarily provide; transmitting it through a customer-service or communications platform; making it available to personnel reasonably necessary to handle your request; using it to respond to the specific product or service request you made; maintaining it where reasonably necessary for the customer-service relationship, warranty, return, dispute, security, or legal purpose involved; transmitting it to a processor acting on our behalf where reasonably necessary; and deleting, deidentifying, aggregating, or otherwise disposing of it when appropriate.
We seek to limit access to Consumer Health Data to personnel and processors for whom access is reasonably necessary for an authorized purpose.
Where a processor processes Consumer Health Data for Marshmalloo, we seek to require that processing to occur in a manner consistent with our instructions, this Policy, applicable contractual requirements, and applicable law.
8. CONSUMER HEALTH DATA WE SHARE
Marshmalloo does not intentionally share Consumer Health Data with third parties or affiliates for their own independent advertising, marketing, profiling, or other independent commercial purposes.
Where permitted by applicable law, Consumer Health Data may be disclosed to processors or service providers acting on Marshmalloo's behalf as reasonably necessary to provide a product or service you requested or perform an authorized business function.
Depending upon the communication and service involved, the categories of Consumer Health Data processed by such providers may include health-condition information voluntarily disclosed by a consumer; pain, discomfort, symptom, mobility, or physical-support information voluntarily disclosed by a consumer; health-related information included in customer-service communications; health-related information relevant to a return, warranty, or product-selection request; and limited information necessary to associate the communication with the customer or request.
Under certain Consumer Health Data laws, disclosures to a processor acting solely on Marshmalloo's behalf may not constitute sharing.
9. CATEGORIES OF RECIPIENTS
Customer-Service and Communications Providers
Providers that assist Marshmalloo with telephone communications, email, customer-service systems, live chat, message routing, transcription, or other customer communications.
AI-Enabled Customer-Service Providers
Providers that assist Marshmalloo in responding to, routing, summarizing, or supporting customer-service communications. We do not authorize these providers to use identifiable Consumer Health Data to train their own general-purpose AI models for independent purposes.
Cloud, Hosting, and Information-Technology Providers
Providers that host, secure, maintain, or support systems through which Consumer Health Data may be processed.
Security and Fraud-Prevention Providers
Providers assisting Marshmalloo with security, system integrity, fraud prevention, or investigation of unlawful activity.
Professional Advisors and Legal Recipients
Attorneys, insurers, auditors, consultants, courts, regulators, law-enforcement authorities, governmental entities, or others where access or disclosure is reasonably necessary and legally permitted.
10. AFFILIATES
Marshmalloo does not share Consumer Health Data with an affiliated company for that affiliate's independent advertising, marketing, profiling, or other independent commercial purposes.
If Marshmalloo begins sharing Consumer Health Data with a specific affiliate in circumstances requiring disclosure or consent under applicable Consumer Health Data law, we will update this Policy and obtain any consent required by law before that sharing begins.
11. SALE OF CONSUMER HEALTH DATA
Marshmalloo does not sell Consumer Health Data.
We do not exchange Consumer Health Data for money or other valuable consideration in a transaction constituting a sale of Consumer Health Data under applicable law.
We do not condition your ability to purchase Marshmalloo products on authorizing the sale of Consumer Health Data.
If Marshmalloo ever proposes to engage in a transaction constituting the sale of Consumer Health Data, we will first obtain the separate written authorization required by applicable law and satisfy all other applicable statutory requirements.
12. ADVERTISING AND CROSS-SITE TRACKING
Marshmalloo uses advertising, analytics, attribution, and similar technologies on its website generally, as described in our general Privacy Policy.
However, Marshmalloo does not intentionally disclose Consumer Health Data to advertising platforms for targeted or cross-context behavioral advertising.
We do not authorize third parties to collect Consumer Health Data from Marshmalloo for the purpose of tracking an individual's health status over time and across unaffiliated websites or online services.
We do not intentionally place medical diagnoses, health conditions, symptoms, treatment information, medication information, pain or injury information, or other Consumer Health Data into advertising audiences or advertising-event payloads.
General website information that does not identify or reveal an individual's health status may continue to be processed under our general Privacy Policy and applicable privacy choices.
13. CONSENT
Where Consumer Health Data is collected because it is necessary to provide a product or service that you requested, applicable law may permit Marshmalloo to process that information for that limited purpose without obtaining separate consent.
For example, if you voluntarily tell a Marshmalloo customer-service representative about a physical condition because you want the representative to take that information into account when responding to your product question, we may use the information to respond to that request where permitted by applicable law.
Where applicable law requires affirmative consent, Marshmalloo will seek a clear affirmative indication of consent before collecting or using Consumer Health Data for the specified purpose.
Where applicable law requires separate consent before sharing Consumer Health Data, consent to sharing will be separate and distinct from consent to collection.
You may withdraw applicable consent to future collection or sharing as described below. Withdrawal applies prospectively and does not necessarily affect processing that occurred lawfully before withdrawal became effective.
14. YOUR CONSUMER HEALTH DATA RIGHTS
Depending upon applicable law, you may have the right to:
- confirm whether Marshmalloo is collecting, sharing, or selling Consumer Health Data concerning you and access Consumer Health Data concerning you that we maintain;
- obtain information concerning third parties or affiliates with whom Consumer Health Data concerning you has been shared or sold, including contact information where required by law;
- withdraw consent to future collection or sharing where processing is based upon your consent;
- request that Marshmalloo cease collecting or sharing Consumer Health Data concerning you where applicable law provides that right;
- request deletion of Consumer Health Data concerning you;
- review Consumer Health Data we maintain concerning you and request correction of information you believe is inaccurate;
- appeal a refusal to take action where applicable law provides an appeal right; and
- exercise rights without unlawful discrimination.
Where required by law, an authenticated deletion request may require Marshmalloo to delete applicable Consumer Health Data from our records, notify processors or other legally required recipients of the deletion request, and direct those recipients to delete applicable Consumer Health Data from their records. Deletion from archived or backup systems may be delayed for the period permitted by applicable law.
15. HOW TO EXERCISE YOUR RIGHTS
Email: info@marshmalloo.com
Subject line: Consumer Health Data Privacy Request
Telephone: 1-844-766-7375
Mail:
Marshmalloo LLC
1309 Coffeen Ave.
Sheridan, WY 82801
United States
If Marshmalloo provides an online Privacy Request form, you may also use that mechanism.
When submitting a request, please tell us that your request concerns Consumer Health Data, identify the right you wish to exercise, and provide sufficient information for us to identify the relevant customer interaction or record.
Please do not send additional medical details merely to submit a privacy request.
16. AUTHENTICATING REQUESTS
We may take reasonable steps to authenticate your identity before fulfilling a Consumer Health Data request. Authentication measures will depend on the nature of the request, the sensitivity of the information, the risk of unauthorized access or deletion, and information reasonably available to Marshmalloo.
We will request only information reasonably necessary to authenticate and process the request. If we cannot reasonably authenticate a request using commercially reasonable efforts, we may request additional information reasonably necessary or decline to act where permitted by applicable law.
We will not require a consumer to create a new account solely to exercise Consumer Health Data rights where prohibited by applicable law.
17. RESPONSE TIME
We will respond to authenticated Consumer Health Data requests without undue delay and within the period required by applicable law.
Where applicable Washington or Nevada Consumer Health Data law applies, we generally will respond within 45 days after receiving the request.
Where reasonably necessary and legally permitted, the response period may be extended once for up to an additional 45 days, taking into account the complexity and number of requests. If we extend the response period, we will provide notice of the extension and the reason for it within the initial response period.
Requests will be processed without charge to the extent required by law. Where applicable law permits a reasonable fee or refusal for manifestly unfounded, excessive, fraudulent, or repetitive requests, Marshmalloo reserves the right to exercise that authority.
18. DELETION REQUESTS
When applicable law requires deletion of Consumer Health Data, Marshmalloo will take the actions required by that law. This may include deleting applicable Consumer Health Data from our systems, notifying applicable processors or other recipients, and directing those recipients to delete applicable Consumer Health Data where required by law.
Where Consumer Health Data is maintained in archived or backup systems, deletion may be delayed for the period permitted by applicable law. Certain information may be retained where applicable law expressly permits or requires retention.
19. APPEALS
If Marshmalloo refuses to take action on a Consumer Health Data request and applicable law gives you a right to appeal, you may submit an appeal by contacting info@marshmalloo.com with the subject line Consumer Health Data Privacy Appeal.
Please identify the request or decision being appealed and explain why you believe it should be reconsidered. We will review the appeal and respond within the period required by applicable law.
Where applicable Washington or Nevada law applies, we generally will respond in writing within 45 days after receiving the appeal. If an appeal is denied, we will provide information required by applicable law concerning how you may contact the applicable state Attorney General or other regulatory authority.
20. SECURITY OF CONSUMER HEALTH DATA
Marshmalloo maintains administrative, technical, organizational, and physical safeguards designed to protect Consumer Health Data in a manner reasonable and appropriate in light of the nature and sensitivity of the information, volume processed, purposes for processing, and reasonably foreseeable risks.
We seek to restrict access to Consumer Health Data to personnel and processors for whom access is reasonably necessary to provide a requested product or service, carry out a purpose to which the consumer consented, maintain security, prevent fraud, comply with law, or carry out another legally permitted purpose.
No electronic transmission, network, system, or storage method can be guaranteed to be completely secure.
21. GEOFENCING
Marshmalloo does not use geofencing technology around healthcare facilities or other locations providing in-person health care services for the purpose of identifying or tracking consumers seeking health care services or products, collecting Consumer Health Data, or sending advertisements, messages, or notifications based upon Consumer Health Data or a consumer's presence at such a location.
22. MATERIAL CHANGES TO THIS POLICY
We may update this Consumer Health Data Policy when our practices or applicable laws change.
If we make a material change affecting how Consumer Health Data is collected, used, processed, or shared, we will provide any notice required by applicable law. Depending upon the circumstances, notice may be provided through a conspicuous notice on our website, a notice through the relevant communication or feature, email or another electronic communication where appropriate, or another method reasonably designed to notify affected consumers.
We will update the Last Updated date shown at the top of this Policy.
Where applicable law requires affirmative consent before Marshmalloo collects, uses, or shares an additional category of Consumer Health Data; uses Consumer Health Data for a materially different or additional purpose; or shares Consumer Health Data with an additional third party or affiliate, we will provide the required disclosure and obtain the required consent before beginning that activity.
23. RELATIONSHIP TO OUR GENERAL PRIVACY POLICY
This Consumer Health Data Policy applies specifically to information qualifying as Consumer Health Data.
Our general Privacy Policy describes broader Marshmalloo privacy practices concerning ecommerce transactions, accounts, website activity, cookies and pixels, advertising and analytics, artificial intelligence, communications, general state privacy rights, and other personal information.
If there is a conflict between this Consumer Health Data Policy and our general Privacy Policy concerning information that qualifies as Consumer Health Data, this Consumer Health Data Policy will control to the extent required by applicable Consumer Health Data law.
24. CONTACT US
Questions or requests concerning Consumer Health Data may be directed to:
Marshmalloo LLC
1309 Coffeen Ave.
Sheridan, WY 82801
United States
Email: info@marshmalloo.com
Telephone: 1-844-766-7375
For requests concerning Consumer Health Data, please identify your communication as a Consumer Health Data Privacy Request so that it can be routed appropriately.
