Privacy Policy

Last updated: September 2026

1. Introduction

This privacy policy explains how VR Lab B.V. handles data in the Virtual Life Support (VLS) app. VLS is a VR training application that teaches CPR (cardiopulmonary resuscitation) and AED use, based on official resuscitation guidelines.

VLS currently runs on Meta Quest and Pico headsets. This policy applies to VLS on all headsets we support, including any additional headsets we may support in the future.

This policy covers the VLS app itself. It does not cover the virtuallifesupport.eu website, including the page where trainees can retrieve their training results. That page has its own privacy statement, available at virtuallifesupport.eu/privacy-statement-eu/.

2. Who we are

VLS is developed and published by:

VR Lab B.V.
Winselingseweg 109
6541 AH Nijmegen
The Netherlands

Email: support@virtuallifesupport.eu
Phone: +31 24 669 0027

VR Lab B.V. is the data controller for the data described in this policy.

3. Summary

VLS is built with privacy by design. A trainee can complete a full training session without VLS collecting their name, email address, student number, employee number, or any other information that identifies them personally.

VLS is sold to organizations, such as schools, healthcare institutions, and companies (business to business). Individual trainees do not create an account and do not log in.

4. Data VLS processes

4.1 Body, hand, and head movement during training

VLS uses hand tracking to run the training simulation. While a trainee performs the training, the app reads hand and head movement in real time to run the simulation and to assess technique, for example the rate and depth of chest compressions.

This movement data is processed in the moment, to run the simulation and calculate feedback. It is not stored and not sent to our servers. Only the resulting performance metrics described in section 4.3 may be saved, and only if the trainee actively chooses to do so.

4.2 Camera use for license activation

When a license is activated on a headset for the first time, VLS briefly uses the headset camera to scan a QR code. The camera is used only to read this code. No images or video are stored, processed further, or sent outside the headset.

4.3 Training results

VLS does not save training results by default.

When a trainee uses VLS online, they can choose at the end of a session to save their results. If they do, VLS generates a random session code and stores the following:

• The session code
• Date and time of the session
• Scenario settings (environment, victim)
• Type of training manikin or setup used
• Measurement method used (headset, SimCPR wristband, or manikin)
• Overall score and detailed performance metrics: compression rate, compression depth, number and quality of compressions, number of breaths, hands off time, chest compression fraction, and results per step of the resuscitation checklist

None of this data includes a name, initials, or any other information that identifies the trainee, and VR Lab cannot link a session code back to an individual.

The session code lets the trainee retrieve their results on virtuallifesupport.eu for at least two weeks. After that, the code stops working and the result is no longer accessible through the website. VR Lab keeps the anonymous result internally afterward, for statistical analysis and product development, and periodically cleans up older records.

If a trainee uses VLS offline, results cannot be saved at all, not even temporarily on the headset.

4.4 Microphone use during training

Some training scenarios ask the trainee to speak, for example to simulate calling emergency services or instructing a bystander. VLS needs microphone permission for this. Audio is processed briefly in the headset’s memory to detect that the trainee is speaking. VLS does not record or store audio, on the headset or anywhere else.

4.5 Optional Bluetooth devices

VLS can connect over Bluetooth to two optional external devices used in some training setups: the SimCPR Pro Trainer wristband and Laerdal QCPR manikins. Paired devices are stored as “known devices” on the headset itself. VR Lab does not receive or store any Bluetooth device information on its servers.

4.6 Technical and diagnostic data

To keep VLS running and to support customers remotely, VR Lab processes technical data about the headset and installation: headset model, operating system version, VLS version, and when the headset was last online. This data is not linked to a trainee and does not include training results.

VLS may also send crash and error logs to help us fix technical problems. These logs are meant to contain only technical information. Occasionally, free text in an error message could unintentionally include other information, and we limit what goes into these logs as much as possible.

4.7 Anonymous product usage data

VR Lab collects fully anonymous data about how VLS is used, to analyze and improve the product. This data is not linked to any customer, organization, device, license, user, or session code.

4.8 License and account data

Individual trainees do not have accounts. Licenses for VLS are managed at the organization level. VR Lab processes limited contact information, such as the name and business email address of an organization’s contact person, to manage the license, provide support, and handle billing and contracts. This is described in more detail in the data processing document we provide to business customers on request.

5. What VLS does not do

VLS does not require trainees to create an account or log in. It does not use an advertising ID and does not show ads. It does not sell personal data to third parties, and it does not share personal data with third parties for their own marketing purposes.

6. Why we process this data

We process the data described above to:

• Run the training simulation and give trainees real time feedback
• Let trainees optionally save and retrieve their own results
• Provide technical support and fix problems
• Manage licenses, contracts, and billing for our business customers
• Analyze and improve VLS

7. Legal basis

Where VLS processes personal data, for example the contact details of a license holder, the legal basis is that this processing is necessary to carry out our agreement with that customer. Where a trainee chooses to save their training results, that choice is the trainee’s own decision, and the resulting data is anonymous rather than personal data, so no additional legal basis is required for storing it.

8. Who else processes this data

VR Lab uses the following service providers to run VLS:

Keygen.sh is based in the United States. Data sent to Keygen.sh is protected by Standard Contractual Clauses, the transfer mechanism approved by the European Commission for sending data outside the EU.

We are in the process of removing BugSplat from VLS. Once this change ships, VLS will no longer send any data to BugSplat.

9. How long we keep data

• Contact details for an active license are kept for as long as the license and, where needed for our contracts and accounting, up to 7 years afterward
• Technical activation data is kept for the license period plus up to 12 months
• Crash and error logs are kept for up to 180 days
• Saved training results are publicly retrievable by session code for at least two weeks, then kept internally in anonymous form for product analysis, with older records cleaned up periodically
• Anonymous product usage data is kept for up to 5 years

10. Security

We protect the data described in this policy with industry standard measures, including encrypted connections (TLS) for all data in transit, encryption at rest for data stored on AWS, multi factor authentication for administrative access to our systems, and the principle of least privilege for our backend services. We keep license data, diagnostic data, training data, and usage data separate, and we do not combine them unless necessary.

11. Your rights

Because VLS does not collect information that identifies individual trainees, requests to access, correct, or delete personal training data usually do not apply, since there is no personal data to act on.

If you are a contact person for one of our business customers, you can ask us to access, correct, or delete the personal data we hold about you by emailing support@virtuallifesupport.eu. We will respond within one month. Deletion of contact details needed to run an active license agreement is possible once that agreement ends.

If you believe VLS has processed your personal data in a way this policy does not describe, please contact us at the email address above.

12. Children

VLS is designed for use by trainees in professional and educational settings, under the supervision of an instructor or institution. VLS does not knowingly collect personal data from anyone, including children, because it does not collect personal data from trainees in the first place.

13. Changes to this policy

We may update this policy from time to time, for example when VLS adds new features that change how data is processed. We will update the date at the top of this policy when we do. We encourage you to check back periodically.

14. Contact

For questions about this policy or about data processing in VLS, contact:

VR Lab B.V.
Winselingseweg 109, 6541 AH Nijmegen, The Netherlands
support@virtuallifesupport.eu
+31 24 669 0027