Building the Future of Therapeutic Software

Introduction

This document is meant to clarify the privacy policy of VRapeutic Inc. Particularly, we highlight the
types of information we collect and the justification for this collection to take place. We also explain
how you, as a user, can manage, edit, delete or export your information.
We provide a range of services that help thousands of families worldwide, particularly in the special
education community. Our services include:

• Rehabilitative software developed using virtual reality technology for learning and developmental disorders.
• Personalized educational and therapy plans that are designed and delivered through an effective communication process between parents, teachers, and therapists.
• Appointment booking, online screening tests, and at-home training and assessments.
• Awareness raising resources such as webinars and explainer videos.

As an organization that develops solutions to serve children mainly, and to the best of our capacity,
we ensure that our privacy policy abides by the Children’s Online Privacy Protection Rule (COPPA)
and the General Data Protection Regulation (GDPR).
Our practices to comply with COPPS is realized through the following:

• On a regular basis, we conduct an information audit. This is help us determine, and keep our records updated, regarding what personal information we collect and/or process from kids under 13 and who has access to it.
• We share our policy through our website with all our current and potential customers through which we considered COPPA compliance to the best of our capacity.
• As a part of any contract we sign, there are clear clauses that inform parents about the data collection that is a part of our system. Since we sell to businesses, not families, in many cases, we require the customer to take the parents’ consent before using the system. We share out own template of a parent’s consent with the customer upon their request.
• We highly value and fulfill parents’ ongoing rights with regards to the acquisition and processing of their children’s personal information. This includes, but not limited to, empowering them to request to seize collection, update, or delete all their children’s information from our servers.
• We maintain world-class procedures to ensure the security, confidentiality, and integrity of the information we collect from children and their families. These procedures involve:

         o   The minimization of the amount of collected data.

          o    Choosing only third parties that have transparent and effective privacy and data

         o   Securely deleting personal information that are not important any longer to the enhancement of the service we provide to our customers..

Our practices to comply with GDPR is realized through the following:

Lawful basis and transparency

• On a regular basis, we conduct an information audit. This is help us determine, and keep our records updated, regarding what information we process and who has access to it.
• We share with our users a clear and legal justification for each of our data processing activities. This justification can be found in the rest of this document.
• We provide our users with detailed information about the types of data processing we apply accompanied by a legal justification that is included in our privacy policy.

Data security

• In addition to end-to-end encryption, we make sure that all the personal data we acquire is anonymized wherever possible.
• We have an internal security policy in place. This is always taken into consideration by our team members. As an organization, we also take lead in building awareness about data protection, inside the organization and to the public as well.
• On a regular basis, we conduct a data protection impact assessment, and we are alwaysupdating the process required to carry it out.
• Since the organization’s inception, we have had a process in place to notify our customers and data subjects in case a data breach occurred.

Accountability and governance

• We have assigned a team member to be responsible for maintaining GDPR compliance across all our organization’s activities.
• Only if required, we choose third parties which have clear privacy policy and data protection policy that align with ours. We do not have any third party that process data on our behalf except Amazon AWS. Although there is no signal processing agreement between VRapeutic and Amazon, the latter has a clear privacy policy in place
• It is an integral part of our customer success process to empower them to receive all the data and information we have about them. Upon request, we also enable them to correct or update inaccurate or incomplete information, request to delete their personal data, and request to stop processing their data.
• We have also ensured, as a part of our system design, to ensure that a customer would receive their data in a format that is transferrable and shareable with other companies.
• We adopt a “human-in-the-loop” process in every decision made based on automated processes especially in cases where, for example, the result is recommending a rehabilitation plan. The “human” involved is always the specialist supervising the child/enduser.

Before proceeding to the next sections in policy, please note that as a user of VRapeutic, you are abiding by the privacy policies of Google, LLC, and Apple, Inc.

What kind of information do we collect?

We collect information to provide better services to all our users — from figuring out basic stuff like which language you speak, to more complex things like the activities you use more frequently, the connections you make through VRapeutic, when do you use VRapeutic often throughout the day. The information VRapeutic collects, and how that information is used, depends on how you use our services and how you manage your privacy controls.

When you’re not signed in to a VRapeutic Account, we store the information we collect with unique identifiers tied to the browser, application, or device you’re using. This helps us do things like maintain your language preferences across browsing sessions.

When you’re signed in, we also collect information that we store with your VRapeutic Account, which we treat as personal information.

THINGS YOU CREATE OR PROVIDE TO US

When you create a VRapeutic Account, you provide us with personal information that includes your name and a password. You can also choose to add a phone number or payment information to your account. Even if you aren’t signed in to a VRapeutic Account, you might choose to provide us with information — like an email address to receive updates about our services

We also collect the content you create, upload, or receive from others when using our services. This includes things like email you write and receive, photos and videos you save, docs and spreadsheets you create, and comments you make on VRapeutic videos.

INFORMATION VRAPEUTIC COLLECTS

YOUR APPS, BROWSERS & DEVICES

We collect information about the apps, browsers, and devices you use to access VRapeutic services, which helps us provide features like automatic product updates and dimming your screen if your battery runs low.

The information we collect includes unique identifiers, browser type and settings, device type and settings, operating system, mobile network information including carrier name and phone number, and application version number. We also collect information about the interaction of your apps, browsers, and devices with our services, including IP address, crash reports, system activity, and the date, time, and referrer URL of your request.

We collect this information when one of VRapeutic’s services on your device contacts our servers for example, when a service checks for automatic updates. If you’re using an Android device with VRapeutic installed on it, your device periodically contacts VRapeutic servers to provide information about your device and connection to our services. This information includes things like your device type, carrier name, and crash reports

YOUR ACTIVITY

We collect information about your activity in our services, which we use to do things like recommend a service you might like. The activity information we collect may include:

• Terms you search for
• Videos you watch
• VRapeutic Inc.
• Empowering neurodiversity, one child at a time
• Views and interactions with content
• Voice and audio information when you use audio features
• Purchase activity
• People with whom you communicate or share content
• Activity on third-party sites and apps that use our services

WHY VRAPEUTIC COLLECTS DATA

We use the information we collect from all our services for the following purposes:

PROVIDE OUR SERVICES

We use your information to deliver our services, like processing the terms you search for in order to return results or helping you share content by suggesting recipients from your contacts.

MAINTAIN & IMPROVE OUR SERVICES

MAINTAIN & IMPROVE OUR SERVICESWe also use your information to ensure our services are working as intended, such as tracking outages or troubleshooting issues that you report to us. And we use your information to make improvements to our services — for example, understanding which search terms are most frequently misspelled helps us improve spell-check features used across our services.

We use data for analytics and measurement to understand how our services are used. For example, we analyze data about your visits to our sites to do things like optimize product design. And we also use data about the ads you interact with to help advertisers understand the performance of their ad campaigns. We use a variety of tools to do this, including Google Analytics.

Communicate with you

We use information we collect, like your email address, to interact with you directly. For example, we may send you a notification if we detect suspicious activity, like an attempt to sign in to your VRapeutic Account from an unusual location. Or we may let you know about upcoming changes or improvements to our services. And if you contact VRapeutic, we’ll keep a record of your request in order to help solve any issues you might be facing.

Protect VRapeutic, our users, and the public

We use information to help improve the safety and reliability of our services. This includes detecting, preventing, and responding to fraud, abuse, security risks, and technical issues that could harm VRapeutic, our users, or the public.

We use different technologies to process your information for these purposes. We use automated systems that analyze your content to provide you with things like customized search results, personalized ads, or other features tailored to how you use our services. And we analyze your content to help us detect abuse such as spam, malware, and illegal content. We also use algorithms to recognize patterns in data.

If other users already have your email address or other information that identifies you, we may show them your publicly visible VRapeutic Account information, such as your name and photo. This helps people identify an email coming from you, for example.

We’ll ask for your consent before using your information for a purpose that isn’t covered in this Privacy Policy.

YOUR PRIVACY CONTROLS

This section describes key controls for managing your privacy across our services. We offer specific privacy settings in our system.

MANAGING, REVIEWING, AND UPDATING YOUR INFORMATION

When you’re signed in, you can always review and update your information. Through your VRapeutic account, you can also do the following:

EXPORTING, REMOVING & DELETING YOUR INFORMATION

• You can export a copy of content in your VRapeutic account if you want to back it up or use it with a service outside of VRapeutic.
• You can also request to remove content from specific VRapeutic services based on applicable law.
• You can also delete specific pieces of data from VRapeutic or your entire VRapeutic account.

There are other ways to control the information VRapeutic collects whether or not you’re signed in to a VRapeutic Account, including:

• Browser settings: For example, you can configure your browser to indicate when VRapeutic has set a cookie in your browser. You can also configure your browser to block all cookies from a specific domain or all domains. But remember that our services rely on cookies to function properly, for things like remembering your language preferences.

• Device-level settings: Your device may have controls that determine what information we collect. For example, you can modify location settings on your Android device.

SHARING YOUR INFORMATION

Many of our services let you share information with other people, and you have control over how you share. For example, you can share videos on VRapeutic publicly or you can decide to keep your videos private. Remember, when you share information publicly, your content may become accessible through search engines, including Google Search.

When you’re signed in and interact with some VRapeutic services, like leaving comments on a video on VRapeutic, your name and photo appear next to your activity. We may also display this information in ads depending on your Shared endorsements setting

WHEN VRAPEUTIC SHARES YOUR INFORMATION

We do not share your personal information with companies, organizations, or individuals outside of VRapeutic except in the following cases:

WITH YOUR CONSENT

We’ll share personal information outside of VRapeutic when we have your consent. We’ll ask for your explicit consent to share any sensitive personal information.

WITH DOMAIN ADMINISTRATORS

If you work for an organization, a school, or a therapy center that uses VRapeutic services, your domain administrator who manage your account will have access to your VRapeutic Account. They may be able to:

• Access and retain information stored in your account, like your email
• View statistics regarding your account,
• Suspend or terminate your account access
• Receive your account information in order to satisfy applicable law, regulation, legal
• process, or enforceable governmental request
• Restrict your ability to delete or edit your information or your privacy settings

FOR EXTERNAL PROCESSING

We provide personal information to our affiliates and other trusted businesses or persons to process it for us, based on our instructions and in compliance with our Privacy Policy and any other appropriate confidentiality and security measures. For example, we use service providers to help us with customer support.

FOR LEGAL REASONS

We will share personal information outside of VRapeutic if we have a good-faith belief that access, use, preservation, or disclosure of the information is reasonably necessary to:

• Meet any applicable law, regulation, legal process, or enforceable governmental request. We share information about the number and type of requests we receive from governments in our Transparency Report.
• Enforce applicable Terms of Service, including investigation of potential violations.
• Detect, prevent, or otherwise address fraud, security, or technical issues.
• Protect against harm to the rights, property or safety of VRapeutic, our users, or the public as required or permitted by law.

We may share non-personally identifiable information publicly and with our partners — like publishers, advertisers, developers, or rights holders. For example, we share information publicly to show trends about the general use of our services. We also allow specific partners to collect information from your browser or device for advertising and measurement purposes using their own cookies or similar technologies.

If VRapeutic is involved in a merger, acquisition, or sale of assets, we’ll continue to ensure the confidentiality of your personal information and give affected users notice before personal information is transferred or becomes subject to a different privacy policy.

KEEPING YOUR INFORMATION SECURE

All VRapeutic products are built with strong security features that continuously protect your information. The insights we gain from maintaining our services help us detect and automatically block security threats from ever reaching you. And if we do detect something risky that we think you should know about, we’ll notify you and help guide you through steps to stay better protected.

We work hard to protect you and VRapeutic from unauthorized access, alteration, disclosure, or destruction of information we hold, including:

• We use encryption to keep your data private while in transit
• We review our information collection, storage, and processing practices, including physical security measures, to prevent unauthorized access to our systems
• We restrict access to personal information to VRapeutic employees, contractors, and agents who need that information in order to process it. Anyone with this access is subject to strict contractual confidentiality obligations and may be disciplined or terminated if they fail to meet these obligations.

EXPORTING & DELETING YOUR INFORMATION

You can export a copy of content in your VRapeutic Account if you want to back it up or use it with a service outside of VRapeutic.
To delete your information, you can:

• You can also request to remove content from specific VRapeutic services based on applicable law.
• You can asl delete specific pieces of data from VRapeutic or your entire VRapeutic account.

RETAINING YOUR INFORMATION

We retain the data we collect for different periods of time depending on what it is, how we use it, and how you configure your settings:

• Some data you can delete whenever you like, such as the content you create or upload. You can also delete activity information saved in your account, or choose to have it deleted automatically after a set period of time.

• Other data is deleted or anonymized automatically after a set period of time, such as advertising data in server logs

• We keep some data until you delete your VRapeutic Account, such as information about how often you use our services.

• And some data we retain for longer periods of time when necessary for legitimate business or legal purposes, such as security, fraud and abuse prevention, or financial recordkeeping.

When you delete data, we follow a deletion process to make sure that your data is safely and completely removed from our servers or retained only in anonymized form. We try to ensure that our services protect information from accidental or malicious deletion. Because of this, there may be delays between when you delete something and when copies are deleted from our active and backup systems.