Jeeze. No way a spa has good enough data protection practices to collect protect that information. But I wonder if it's to discourage guests from being... creepy to the staff.