1. Introduction and Scope
At MetamedicsVR S.L. we take the protection of your data very seriously. This Privacy Policy explains how we collect, use, protect and share the personal information of our users and customers.
MetamedicsVR provides interactive voice simulation services powered by artificial intelligence, aimed at educational institutions and companies for the practical training of their students or employees.
This policy applies both to:
- Users who access our website, request information or register individually (we act as Data Controller), and to
- Institutional clients (educational centres, universities, companies) that hire us to offer our platform to their students or employees (we act as Data Processor of their data).
2. Who is the Controller of your Data?
Legal name: MetamedicsVR S.L.
Tax ID (CIF): B09892159
Address: Plaza del Obispo 6, 29015, Málaga
Contact email: beatriz@metamedicsvr.com
3. What Data we Collect and Why
We collect different types of data depending on how you use our website or services. Here is a clear summary:
| Specific personal information collected | Why it is collected and for what purposes | Consequences of not providing the information |
| When you browse or visit our website | ||
| Cookies, analytics tools and log files. | For statistics and marketing purposes. More information in our Cookie Policy. | Some features of the website may not be available. |
| When you subscribe to receive our updates or newsletters | ||
| Email address. | To sign you up to our updates and send you marketing communications. | We will not be able to sign you up or send you marketing communications. |
| When you request a demo or use our free trial version | ||
| Full name, email address, company name, phone number. | To provide you with access to the trial simulation, offer you a demo and send you related communications. | You will not be able to access the free trial, receive a demo or receive related communications. |
| When you register, log in and use the Service | ||
| Full name, email address, company name, information about your use of the service (such as simulation exercises, photos, activity history), and any other information you upload to the platform. | To create your account, allow you to log in and use the service, personalize the experience, generate simulation analysis reports, send you communications and comply with the service agreement. | We will not be able to create your account, allow you access, personalize the experience, generate reports or improve the service. |
| When you purchase a subscription to the Service | ||
| Payment information, full name, email address. | To process your payment and manage your subscription. | We will not be able to process your payment or activate your subscription. |
| When you contact us (support, help, social media, etc.) | ||
| Full name, email address, company name, phone number, and any other information you provide in your message. | To receive, process and respond to your request. | We will not be able to handle your request or answer your enquiries. |
| When you attend a marketing event, give us your business card or personal data for commercial purposes | ||
| Full name, job title, email address, company name, phone number, and any other information provided. | To establish a commercial relationship and send you marketing communications. | We will not be able to establish a commercial relationship or send you communications. |
| When we use the personal data of our service providers | ||
| Full name, email address, phone number, company name, and any other information provided. | To contact our providers and execute commercial agreements. | We will not be able to contact our providers or execute the agreements. |
4. Processing as Data Controller
MetamedicsVR acts as Data Controller when you interact with us as a visitor or individual user, for example:
- You request a demo or information
- You register independently on the platform
- You write to us for support or marketing
- You browse our website
In these cases, we decide how and why we process your data. Your rights as a data subject are covered by the General Data Protection Regulation (GDPR) and other applicable local laws.
5. Processing as Data Processor
When an educational institution or company hires our services and authorizes us to process the data of its students, employees or users, MetamedicsVR acts as Data Processor.
The institution decides what data is collected and for what purpose, and we process it only under its instructions, under a Data Processing Agreement (art. 28 GDPR).
6. Data Retention
We keep your data only for as long as necessary for each purpose:
- For the duration of the contractual relationship
- Until you withdraw your consent (for commercial communications)
- For the time required by law (tax, accounting or legal)
- 90 days after the end of a service or cancellation of the account, except where there is a legal obligation or pending dispute
Once the period has elapsed, we securely delete or anonymize the information.
7. Security
At MetamedicsVR we take data security very seriously. For this reason, we have implemented technical and organizational measures designed to protect information against:
- Unauthorized access
- Loss, alteration or destruction
- Improper disclosure
These measures include data encryption, role-based access control, encrypted passwords, firewalls, activity logging, backups and specific security protocols.
Although we apply the best reasonable practices to protect the Platform, no system is completely foolproof. Therefore, we cannot guarantee absolute security against all possible external threats or unforeseen failures.
8. Sub-processors and Providers
In order to provide our services effectively and securely, at MetamedicsVR we work with specialized providers that may have limited access to certain data, always under confidentiality agreements and regulatory compliance. These include:
- Amazon Web Services (AWS): cloud storage and processing.
- Hostinger: web hosting and backend management.
- Hostalia: domain management and email services.
- Google Workspace: email management and collaborative tools.
- Other email, analytics and CRM providers, all engaged under EU Standard Contractual Clauses (SCC) and conditions that guarantee an adequate level of data protection.
Whenever possible, data processing is carried out within the European Economic Area (EEA). In cases where international transfers are necessary, we apply the appropriate safeguards in accordance with the General Data Protection Regulation (GDPR), including the SCC approved by the European Commission.
9. Processing of Student Information
When we offer our services through an educational institution, we process student data solely on behalf of that institution, and in accordance with its authorization and the terms set out in the contract.
We are committed to complying with:
- General Data Protection Regulation (GDPR) – European Union
- FERPA – United States (Family Educational Rights and Privacy Act)
- COPPA – U.S. (Children’s Online Privacy Protection Act, where applicable)
- SOPIPA and other state educational privacy laws in the U.S.
9.1 Principles applied to the processing of student data
- We do not sell students’ personal information.
- We do not use their data for advertising or commercial purposes.
- We do not create student profiles beyond what is necessary for the educational process.
- We only retain data for the time strictly necessary to provide the educational service.
- We offer instructors tools to view activity and academic progress only within their assigned group.
10. Information Collected from Students
10.1 Information provided by students
- First and last name
- Email address (provided by the institution or by the student)
- Profile photo (optional)
- Encrypted password
- Results of exercises, attempts, audio recordings if any
- Assignment to virtual classes via code
10.2 Information collected automatically
- IP address (for technical and security purposes)
- Browser, language, operating system and device type
- Activity logs (interactions, simulations performed, dates)
10.3 Anonymized information
Instructors and teachers of educational accounts can see their students’ data in identified form. At MetamedicsVR we apply anonymization and pseudonymization techniques to analyze usage patterns without linking data to an identifiable person.
We are committed to not attempting to re-identify anonymized information or to share it with unauthorized third parties.
11. User Rights
In accordance with applicable regulations, including the General Data Protection Regulation (GDPR), you have the following rights with respect to your personal information:
- Right of access: You may request information about the personal data we hold about you.
- Right to rectification: You may request the correction of inaccurate or incomplete data.
- Right to erasure (“right to be forgotten”): You may request the deletion of your personal information from our records. However, in some cases, we may be required to retain certain data for legal reasons or to defend against claims.
- Right to restriction of processing: You may request that we restrict the processing of your information in certain circumstances.
- Right to object: You may object to the processing of your data when it is based on our legitimate interest or on automated decisions.
- Right to data portability: You have the right to receive your data in a structured, commonly used and machine-readable format, and to transmit it to another controller where technically feasible.
- Right not to be subject to automated decisions: You may request that decisions not be made based solely on the automated processing of your data.
- Right to withdraw your consent: If the processing of your data is based on your consent, you may withdraw it at any time. However, this will not affect the lawfulness of processing based on consent prior to its withdrawal.
- Right to lodge a complaint: You may file a complaint with the relevant data protection authority in your country if you consider that the processing of your data infringes current regulations. Before doing so, we would appreciate it if you tried to resolve any issue directly with us.
How to exercise your rights
Write to us at: beatriz@metamedicsvr.com
Include your name, email address and the right you wish to exercise.
We will respond within a maximum period of 30 days, which may be extended in complex cases.
12. Account Cancellation and Data Deletion
You can request the deletion of your account by writing to beatriz@metamedicsvr.com.
Once deleted:
- Your access and content will be removed from the platform.
- We will retain certain data if we are legally required to do so or if there is a potential or actual dispute.
13. Commercial Communications (Marketing)
We may send you emails with news, offers or invitations if:
- You have given us your express consent (opt-in), or
- You are already a client and we are communicating similar services to you (legitimate interest).
You can opt out at any time:
- By clicking “Unsubscribe” in the emails
- Or by writing to: beatriz@metamedicsvr.com (subject: UNSUBSCRIBE)
14. Changes to this Policy
We reserve the right to update this Privacy Policy when necessary.
We will notify you by email or through a notice on the platform if the changes are substantial.
15. GDPR Compliance
For our educational services offered in the European Union and the European Economic Area (EU/EEA), MetamedicsVR S.L. processes personal data in accordance with this policy in its capacity as data processor under the General Data Protection Regulation (GDPR).
In this context:
- The educational institution (school, university or training centre) acts as the controller of the personal data.
- MetamedicsVR S.L. acts as data processor, processing the data exclusively according to the instructions of the educational institution.
16. Contact
For questions, complaints or requests regarding privacy:
- beatriz@metamedicsvr.com
- Address: Plaza del Obispo 6, 29015 Málaga
17. Acceptance of the Privacy Policy
By using the services of MetamedicsVR, you acknowledge that you have read and understood this Privacy Policy, and consent to the collection, use and processing of your personal data as described in this document.