Who we are. ORamaVR SA, Geneva, Switzerland. We provide the VTC medical extended-reality training platform, ORamaVR Creator and related services.
What this policy covers. Personal data we decide about ourselves: our website, business contacts, customer administrators and billing contacts, Creator Solo users, support requests and job applicants.
What it does not cover. If your hospital, university, company or distributor gave you access to the VTC Platform, that organisation decides about your training data. We process it on its behalf (Section 2).
Our commitments. We do not sell personal data and we do not show advertising. Our main hosting is in the European Union (the Netherlands). Some providers are in the United States (Section 7).
Your rights. You can ask us for access, correction, deletion and more. You can object at any time to marketing, and to uses based on our legitimate interests (Section 9). Write to support@oramavr.com.
Regional information. Annexes A–E at the end of this policy add what the law of the United Kingdom, the United States, Japan, the United Arab Emirates and China requires.
The controller is ORamaVR SA, 34 route de la Galaise, c/o FONGIT, CH-1228 Plan-les-Ouates, Geneva, Switzerland (CHE-478.871.980). For any privacy question or request, write to support@oramavr.com, or by post to the address above.
This policy applies where ORamaVR decides why and how personal data is used. It does not apply to the data we process for our customers — hospitals, universities, medical-technology companies (OEMs) and the customers of our distributors — when they use the VTC Platform, JARIA or a custom simulation we build for them. For that data the customer is the controller, and its own privacy notice applies. We act only on its instructions, under our Data Processing Agreement.
If you are a trainee or instructor using the platform through your organisation, please contact your organisation with privacy questions. If you write to us instead, we will pass your request on to it.
| Who / what | Why we use it | Legal basis¹ | How long |
|---|---|---|---|
| Website visitors — IP address, device and browser data, pages viewed, cookies (Section 6) | To run and secure the website; analytics and marketing attribution only with your consent | Legitimate interests; consent for analytics | Server logs 90 days; cookies as in Section 6 |
| Enquiries, prospects and business contacts — name, business e-mail and phone, organisation, role, correspondence | To answer you, manage our business relationship and send relevant B2B updates (you can opt out at any time) | Legitimate interests; consent where the law requires it | 24 months after the last contact; opt-out records kept so we can respect them |
| Customer administrators and billing contacts — name, e-mail, role, organisation, login data; invoices, payment records and the customer’s bank details | To provide the service under the contract and to invoice | Contract; legal obligation (accounting) | Account data until 90 days after the contract ends; accounting records 10 years (Swiss CO Art. 958f) |
| Creator Solo users — name, e-mail, country, login and licence data, eligibility declaration | To provide the free licence, check eligibility and keep the service secure | Contract; legitimate interests | While the account is active; deleted 24 months after the last login |
| Support requests — your message, attachments, our replies | To resolve your request | Contract; legitimate interests | 36 months after the case is closed |
| Security logs for our own systems — IP address, time, event | To protect our services and prevent abuse | Legitimate interests | 90 days, longer only for an active investigation |
| Service data from our products — usage counts, error and performance logs, device type | To keep the products working and secure, and to produce aggregated statistics | Legitimate interests | 12 months; aggregated statistics contain no personal data |
| OMEN prompts, where you use ORamaVR Creator under your own account (e.g. Creator Solo) | To generate the images you ask for | Contract | Not kept by us after the image is delivered |
| Job applicants — CV, correspondence, interview notes | To assess your application | Steps before a contract; consent for our talent pool | 6 months after the decision; 24 months with your consent |
| Publishers, distributors and suppliers — contact details and contract records | To manage the contract | Contract; legitimate interests | For the relationship plus 24 months; contracts and accounting records 10 years |
¹ Legal bases under the GDPR and UK GDPR. Under Swiss law no legal basis is needed for lawful processing, but we apply the same standards. Our legitimate interests are answering enquiries, developing business relationships, securing our systems and defending legal claims.
Where we did not collect data from you, we received it from your employer or organisation (our customer), from our distributors, or from public professional sources such as your organisation’s website or events you attended.
Some data is required by law (accounting and tax records) or by contract (account and billing data); without it we cannot open your account or invoice. Everything else is optional. We make no decisions about you based solely on automated processing that have legal or similarly significant effects. Statistics we share with simulation publishers are aggregated across at least five customer organisations and contain no personal data.
• JARIA. JARIA is the AI voice assistant in the VTC Platform. When you use it through your organisation, your spoken questions are transcribed and answered by AI on your organisation’s behalf (Section 2).
• OMEN. OMEN is the AI co-pilot in ORamaVR Creator. Image generation runs through our AI service provider (Section 5). Text features use your own AI provider account, under that provider’s terms.
• No training. We do not use personal data, training sessions or your content to train AI models, and our AI providers are contractually barred from doing so, unless your organisation has expressly opted in under the JARIA Terms of Use §5.3.
• Transparency. AI outputs are generated automatically and may be inaccurate. They are training aids, not clinical advice. We tell you when you are interacting with AI, and AI-generated images and audio are marked as AI-generated where the EU AI Act requires it.
• Service providers: our affiliate ORamaVR Single Member S.A. (Greece), which supports our development, support and sales; hosting and cloud (Microsoft, EU region); AI services for OMEN image generation; website analytics and CRM (Google Analytics and HubSpot, only with your consent); e-mail and communications; accounting, invoicing and payment services; video embeds (YouTube, when you play a video). They act on our instructions under contract.
• Distributors: if you buy through a distributor, the distributor and ORamaVR each receive the contact and order details they need for their own part.
• Others: professional advisers and auditors; authorities where the law requires it; a buyer or successor in a corporate transaction, under equivalent protection.
We do not sell personal data, share it for advertising, or show advertising. The providers that process our customers’ data are listed in our Sub-Processor Register at oramavr.com/legal/sub-processors.
Our website uses a consent banner. Only strictly necessary cookies are set until you choose. You can change your choice at any time through the “Cookie Preferences” link in the website footer. We use no advertising cookies.
| Category | Provider | Cookies | Duration |
|---|---|---|---|
| Strictly necessary (always on) | CookieYes (consent record); ORamaVR portal | The consent cookie (cookieyes-consent); portal login and security cookies. The banner lists every cookie by name. | Session to 1 year |
| Functional (consent) | YouTube / Google LLC — only when a page with a video loads | __Secure-ROLLOUT_TOKEN | About 6 months |
| Analytics (consent) | Google Analytics 4 (property G-8G65EPRCR9) | _ga, _ga_8G65EPRCR9 | 2 years |
| Analytics and CRM (consent) | HubSpot, Inc. | __hstc, hubspotutk | About 6 months |
Our main hosting is in the Netherlands (EU). We also send personal data to the United Kingdom and the United States, where our providers operate, and to the countries of our distributors and publishers, currently member states of the EU/EEA, Switzerland and the United States. We update this list when we start working with a partner in another country. If you work for one of our customers, your details also go to that customer, in the country where it is established; our customers are currently in the EU/EEA, Switzerland, the United Kingdom, the United States and the United Arab Emirates. Where a country has no adequacy finding, we transfer data only where it is necessary to conclude or perform a contract with you or in your interest (FADP Art. 17(1)(b); GDPR Art. 49(1)(b)–(c)), or under standard contractual clauses.
For transfers from Switzerland, the EU and the UK we rely on adequacy findings (the EU/EEA, Switzerland and the UK recognise one another). For the United States, we rely on the EU–US Data Privacy Framework and its Swiss and UK extensions where the recipient is certified (Google LLC, HubSpot, Inc. and Microsoft Corporation are), and otherwise on the European Commission’s standard contractual clauses as adapted for Switzerland and the UK. You can ask us for a copy of the safeguards at support@oramavr.com.
Our systems run on Microsoft Azure in the EU. Data is encrypted in transit and at rest, access is limited to staff who need it, and we have a procedure for handling security incidents, including notifying you and the authorities where the law requires it.
You can also ask us to give you access to your data or a copy of it; correct it; delete it; restrict its use; and send it to you or another provider in a common format. Where we rely on your consent, you can withdraw it at any time, without affecting the lawfulness of processing before the withdrawal.
Write to support@oramavr.com. We may need to confirm your identity. We answer within 30 days (under the GDPR, within one month, extendable by two months for complex requests), free of charge, unless a request is manifestly unfounded or excessive. You may also complain to the Swiss Federal Data Protection and Information Commissioner (edoeb.admin.ch) or to the data protection authority where you live or work. Annexes A–D add what is specific to some countries.
Our services are for professionals and students aged 18 or over, and are not directed at children. Where an institution gives younger students access, the institution is responsible for that use as controller.
The effective date is at the top of this policy. If we make a material change that affects account holders, we tell them by e-mail or in the product at least 30 days before it takes effect. Earlier versions are available on request. This policy replaces the Privacy Policy v1.0 and the Cookie Policy (OVR-POL-003); a reference in any ORamaVR agreement to the Cookie Policy is a reference to Section 6.
The UK GDPR and the Data Protection Act 2018 apply to data about people in the UK. You may first complain to us at support@oramavr.com; we will acknowledge your complaint within 30 days and respond without undue delay. You may also complain to the Information Commissioner’s Office (ico.org.uk). Transfers from the UK to Switzerland and the EEA rely on UK adequacy regulations; transfers to the US rely on the UK Extension to the Data Privacy Framework or the UK Addendum to the standard contractual clauses.
ORamaVR serves businesses and institutions. We currently believe that US state consumer privacy laws do not apply to us; we nonetheless honour the following voluntarily. We do not sell personal information, “share” it for cross-context behavioural advertising, or use sensitive personal information to infer characteristics about you. If you live in a US state with a consumer privacy law, you may ask to know, access, correct or delete the personal information we hold about you by writing to support@oramavr.com. An authorised agent may act for you with your written permission. We will not treat you differently for exercising your rights. If we decline a request, you may appeal by replying to our answer with “appeal”. Where we process data for a US customer, we do so as its service provider under contract.
We are a business established outside Japan. We provide personal data to recipients in Switzerland, the European Union, the United Kingdom, the United States and the United Arab Emirates, as described in Section 7. Japan’s Personal Information Protection Commission recognises the EU and the UK as having equivalent protection. Switzerland has a comprehensive data protection law (the FADP). The United States has no comprehensive federal privacy law. The UAE has a federal data protection law (Federal Decree-Law No. 45 of 2021) whose implementing regulations have not yet been issued. Our recipients in Switzerland, the United States and the UAE are bound by contract to measures equivalent to those required by the APPI (details on request). Our security measures are summarised in Section 8. Our representative is Georgios Papagiannakis, at the address in Section 1. Requests go to support@oramavr.com.
Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data applies to data about people in the UAE. You have the rights described in Section 9, and transfers follow Section 7. Residents of the DIFC and ADGM free zones are covered by those zones’ own laws; we apply the same rights and contact to them voluntarily.
Not currently in use. ORamaVR does not provide services directly to individuals in mainland China. A dedicated annex will be published before any such service starts.