Therapy withVR

Educational Use Policy

This Educational Use Policy explains how Therapy withVR may be used in schools, school districts, universities, and other educational settings. It describes withVR BV's commitments regarding student data, supervised use, applicable regulations, and the agreements available to educational institutions.

This policy applies to all educational users of the Therapy withVR platform, including the Web App and the VR App on Meta Quest headsets. It should be read alongside the Privacy Policy, Terms of Service, and EULA, all available at withvr.app.

1. Supervised Use

Therapy withVR is a professional tool for adults. The Platform is intended for use by educators, speech-language professionals, and researchers who are 18 years of age or older.

The Platform may be used with students of any age, including minors, provided the following conditions are met:

• All sessions are operated under the supervision and control of a qualified adult professional at all times
• The supervising professional creates and manages the account - students do not create accounts
• Students do not enter any personal information into the Platform directly
• No student names, student identifiers, or personally identifiable information about students is entered into the Platform
• Appropriate parental or guardian consent is obtained before the Platform is used with a minor, in accordance with applicable law and institutional policy

Note: Meta Quest headsets have a platform-level minimum age requirement of 10 years. This is a Meta policy, not a withVR BV policy, and applies regardless of professional supervision.

2. Student Data Commitments

withVR BV makes the following commitments with respect to student data:

3. Regulatory Frameworks

3.1 FERPA (US)

FERPA (Family Educational Rights and Privacy Act) obligations rest with educational institutions, not with withVR BV directly. The Platform is designed to support FERPA-compliant use.

The Platform is not designed to receive or process student educational records. Session data does not constitute an educational record as defined under FERPA. The supervising professional is responsible for ensuring that no FERPA-protected data is entered into the Platform.

withVR BV will work with institutions to address specific FERPA requirements on request. A Data Processing Agreement is available - see Section 7.

3.2 COPPA (US)

COPPA (Children's Online Privacy Protection Act) applies to online services that collect personal information from children under 13. The Platform is not directed at children and does not collect personal information directly from any user, including children.

When the Platform is used with children under 13 in a school context, the school acts as the account holder under COPPA's school official exception - students do not interact with the Platform directly as users. Educational institutions using the Platform with children under 13 are responsible for ensuring their use is consistent with COPPA requirements and their own data governance policies.

3.3 GDPR and UK GDPR (EU and UK)

withVR BV processes personal data in accordance with GDPR and UK GDPR. For educational use in the EU and UK, the following applies:

• The digital consent age for data processing by online services varies by EU member state, typically between 13 and 16 years. This applies to the individual's own consent over their personal data processing. Since students do not create accounts or submit personal data to the Platform directly, this threshold applies to the supervising professional's account, not to the student's participation in a session.
• The supervising professional is responsible for compliance with any parental consent requirements applicable to the use of technology with minors in their jurisdiction.
• The ICO Children's Code (UK) requires services likely to be accessed by children to implement appropriate age assurance and privacy protections. The Platform is a professional tool not directed at children; students participate in sessions under adult supervision and do not independently access the service.

3.4 State and regional education privacy laws

In addition to FERPA and COPPA, various US states have enacted student privacy laws imposing additional requirements on educational technology vendors, including laws in California (SOPIPA), New York (Education Law 2-d), Colorado, Texas, and others. withVR BV's commitments in Section 2 are designed to support compliance with these frameworks.

Institutions in jurisdictions with specific student privacy requirements beyond those described in this policy are encouraged to contact legal@withvr.app to discuss their specific needs. A Data Processing Agreement or supplementary agreement can be arranged where required.

4. Data Storage and Security

The following technical and organizational measures are in place to protect data processed through the Platform in educational settings:

5. AI Features in Educational Settings

The Platform includes AI-powered features. In educational settings, the following applies.

5.1 Avatar voices

All avatar speech inside VR is generated using Google Text-to-Speech. This is always active - the student inside VR hears a synthesized voice, not a human recording. Only the text of the avatar's speech is sent to Google for synthesis; no student data is transmitted.

5.2 Optional OpenAI features

The following features are optional and off by default. They must be deliberately activated by the supervising professional:

When these features are used, text entered by the supervising professional is sent to OpenAI for processing. Under OpenAI's API data usage policy, API inputs are not used to train OpenAI's models by default. Student names and student identifiers must not be entered into any AI-powered field.

5.3 Institutional AI governance

Educational institutions with specific AI governance policies - for example, policies restricting the use of generative AI tools with students, or requirements for parental disclosure of AI use - are responsible for applying those policies to their use of the Platform's optional AI features. All optional features can be disabled. The supervising professional retains full control over which features are active in any session.

6. No Advertising, No Tracking, No Data Selling

7. Agreements for Educational Institutions

withVR BV offers the following agreements to educational institutions:

8. Data Retention and Deletion

Data retention periods for educational use are governed by the Privacy Policy and, where a Data Processing Agreement is in place, by that agreement. The following summary applies:

The supervising professional may delete profiles and session data at any time within the Platform. Institutions may also request deletion of all data associated with their account by contacting legal@withvr.app. Deletion requests will be fulfilled within 30 days, except where retention is required by law.

9. Data Breach Notification

In the event of a personal data breach affecting data processed under an educational institution's account, withVR BV will:

• Notify the affected institution without undue delay, and in any event within 72 hours of becoming aware of the breach
• Notify the Belgian Data Protection Authority (GBA) as required under GDPR
• Notify the ICO (for UK institutions) as required under UK GDPR
• Provide information about the nature of the breach, data affected, and steps taken to address it

The institution remains responsible for notifying affected parents, eligible students, and any other parties as required by FERPA, applicable state law, or other applicable regulation. withVR BV will cooperate with the institution's breach response process and provide all relevant technical information to support that notification.

10. Changes to This Policy

withVR BV may update this Educational Use Policy from time to time. If we make material changes, we will notify existing users at least 30 days before the changes take effect, by email and/or in-Platform notification.

The version number and effective date at the top of this document identify the version in force. Previous versions are available on request.

11. Contact

For questions about this policy, to request a Data Processing Agreement or FERPA agreement, or to discuss your institution's specific requirements:

withVR BV | Jozef Hebbelynckstraat 21, Merelbeke 9820, Belgium | legal@withvr.app | withvr.app