Privacy Policy

1. Who we are and what this policy covers

MetaMedicsVR is the trade name of METAMEDICSVR, S.L. ("MetaMedicsVR", "we", "us"). We build practical training tools for health sciences and professional education.

This policy explains how we handle personal data when you:

• visit our website metamedicsvr.com or fill in one of its forms (demo, grants, resources, newsletter, contact);
• use our products through an institution or company that has contracted them:
  • MetaMedicsVR AI Platform: AI-powered clinical simulation, content authoring and assessment (web);
  • MetaMedicsVR VR Simulations: virtual reality training apps for Meta Quest headsets;
  • MetaMedicsVR VR Platform: the web platform where VR simulation results are reviewed;
• contact us, or are a customer or supplier contact.

Custom projects developed for a specific client are governed by their own contract.

2. Our two roles

When we decide how your data is used (data controller). This applies to website visitors, people who fill in our forms, newsletter subscribers, and our customer and supplier contacts. Section 3 explains these uses.

When we process data on behalf of an institution (data processor / service provider). When a university, school, training center, hospital or company gives its students or staff access to our products, that institution decides which data is processed and why. We process it only on its documented instructions, under a data processing agreement. Section 4 explains these uses. If you use our products through an institution, contact the institution first about your data; if you contact us, we will forward your request to it.

3. Data we process as controller

We do not sell personal data, and we do not use it for third-party advertising.

4. Data processed in our products (on behalf of institutions)

Accounts are always created by or through an institution. We do not offer individual sign-up.

MetaMedicsVR AI Platform

• Account data: name, institutional email or username, role, password (stored only as a secure hash), class or group. If the institution connects its LMS (for example via LTI), the LMS shares the data needed to create or identify your account and, if configured, receives your grades.
• Activity and results: simulations completed, conversation transcripts with the simulated patient, scores, feedback and progress.
• Voice: if you speak to the simulated patient, your voice is processed in real time to transcribe it and to run the voice conversation. We do not store the audio; only the text transcript is kept.
• Content created by educators: cases, rubrics and materials. Cases are clinical simulations. Educators are instructed not to enter real patient data.

MetaMedicsVR VR Simulations and VR Platform

• Account data: the same as above (name, institutional email or username, role, password).
• Results: for each exercise, the steps completed, time taken, answers given and resulting score. These are sent to the VR Platform, where students see their own results, instructors see their class and administrators see their organization.
• Voice and hand movements: used only to interact with the simulation in real time. They are not recorded or tracked.
• Headset platform: the apps run on Meta Quest headsets and use Meta's platform services. Meta processes data about your headset and Meta account under its own privacy policy.

Technical data in all products: IP address, device and browser data, and security and activity logs.

Who can see the data: each user sees their own results; instructors see the users they are assigned to; institution administrators see their organization. MetaMedicsVR staff access it only when needed to provide support or operate the service.

5. Artificial intelligence

• Simulated patients and avatars are generated by AI. Feedback and scores are produced automatically against the rubric defined by the educator, who can review and change them. We do not make decisions with legal or similarly significant effects about you based solely on automated processing; any academic decision belongs to your institution.
• We do not train AI models with your data. We do not use your data, conversations, transcripts or results to train, fine-tune or improve AI models, our own or third parties'. Our AI providers are engaged so that they do not use this data for training, and they retain it only for the limited period set out in their standard terms, for security and abuse prevention.
• Only what is needed reaches AI providers. Your name, email and password are not sent to them. They receive the conversation content (and, when you use voice, the audio needed to transcribe it and run the conversation) and the instructions needed to generate each response.

6. Service providers

We use the following providers, under contracts that require them to protect the data and use it only to provide their service to us:

Some VR experiences that include AI conversation use the same AI providers listed above.

7. Where your data is stored and international transfers

All the data stored by our products is kept in the European Union (AWS, Paris). Some providers (mainly the AI and voice providers) may process content outside the European Economic Area at the moment it is processed. When that happens, we rely on the safeguards of the GDPR: the European Commission's Standard Contractual Clauses and/or the EU-U.S. Data Privacy Framework, as applicable to each provider.

8. How long we keep data

• Product data: for as long as the institution's contract is in force. When the contract ends, access is closed and the data is deleted within 90 days, unless the institution asks us for a copy first or the law requires us to keep it. Backups expire automatically within 30 days.
• Audio: not stored. It is discarded once transcribed and processed.
• Website, forms and newsletter: as indicated in the table in section 3.
• Data we must keep by law (for example, invoices) is kept for the legally required period.

9. Security

Our measures include:

• encrypted connections (HTTPS);
• encryption of databases and files at rest (AES-256);
• passwords stored as secure hashes (Argon2);
• role-based access;
• servers closed to external access by default;
• credentials kept out of source code;
• continuous monitoring with alerts;
• separated environments;
• daily backups.

No system is completely secure, but we work to protect your data and to respond quickly to any incident, notifying the institutions concerned as agreed in our contracts.

10. Minors

Our products are designed for higher education, vocational and professional training. We do not allow use by children under 13. Students aged 13 to 17 may use our products only through their educational institution, which is responsible for obtaining any consent or authorization required.

11. Your rights

You can ask us to access, correct or delete your data, to restrict or object to its processing, to receive it in a portable format, and to withdraw your consent at any time (this does not affect processing carried out before you withdraw it).

• If you use our products through an institution, the institution handles your request. You can contact it directly or write to us; we will forward your request to it without undue delay.
• For everything else, write to support@metamedicsvr.com indicating your request. We will reply within one month (extendable in complex cases, in which case we will tell you).

12. European Union and EEA

• Our lead supervisory authority is the Spanish Data Protection Agency (AEPD, www.aepd.es). You can lodge a complaint with it or with the authority of your country. We would appreciate the chance to resolve any concern first.
• Legal bases for our own processing are listed in section 3. For product data, the legal basis is determined by the institution as controller.
• You can unsubscribe from commercial communications at any time using the link in each email or by writing to support@metamedicsvr.com.

13. United States

Student data. When we provide our products to U.S. educational institutions, we act as a school official with a legitimate educational interest under FERPA, under the direct control of the institution with respect to education records. We:

• use student data only to provide the service to the institution;
• do not sell it;
• do not use it for targeted advertising;
• do not build student profiles for purposes other than the educational ones defined by the institution.

On request, we can sign the student data privacy agreement used by the institution, district or state, to the extent it is compatible with our service.

Health information. Our products are designed for training with simulated cases. They are not intended to process protected health information (PHI). Customers and users must not enter real patient data.

Your state privacy rights. Depending on the state where you live, you may have rights to know, access, correct or delete your personal information, and to opt out of certain uses. We do not sell personal information or share it for cross-context behavioral advertising. To exercise any right, write to support@metamedicsvr.com. We will not discriminate against you for doing so. If you are a student or staff member of a customer institution, we will coordinate your request with that institution.

14. Changes to this policy

We may update this policy to reflect changes in our products or in the law. The date at the top shows the latest version. If the changes are significant, we will notify you through the website, the platform or by email.

15. Contact

Privacy contact: David Martín Cabezudo — support@metamedicsvr.com METAMEDICSVR, S.L. · Plaza del Obispo 6, 29015 Málaga, Spain