Last updated on: July 16th 2026 On this page, you will find the Privacy Statement of inMotion VR Holding B.V., hereafter IMVR. IMVR provides Virtual Reality healthcare products and services, and this Statement applies to all products, services and activities of IMVR and its subsidiaries.

1. Definitions

In this Privacy Policy, the following terms have the following meanings:

• inMotion VR Holding B.V. or its subsidiaries: the private limited liability company inMotion VR Holding B.V., established in ’s-Hertogenbosch, with offices at Helftheuvelweg 47, 5222 AV, ’s-Hertogenbosch, the Netherlands, and any of its subsidiaries. Hereafter: IMVR.
• User: any (potential) user or viewer of:
  • one or more (mobile) website(s) for which IMVR is the domain name holder or which are otherwise under the control of IMVR;
  • one or more SaaS services licensed under the control of IMVR; and/or
  • one or more products and/or services developed, offered, sold, or provided by IMVR.
• Products and/or Services: all products and/or services (separately or together) that IMVR operates, offers, sells or otherwise provides to Users, including (but not limited to):
  • websites such as inmotionvr.com and corpusvr.com; and
  • applications built by IMVR, such as Corpus VR.

2. General

2.1 Company information

If you participate in one of our products or contact IMVR or otherwise use services provided by IMVR your personal data as provided and used by you will be recorded and processed. The party responsible for processing such data is inMotion VR Holding B.V., the Netherlands. IMVR aims to exercise every due care with any personal data you provide and to treat these confidentially. IMVR complies with Data Protection regulations applicable in The Netherlands. Company name: inMotion VR Holding B.V. Address: Helftheuvelweg 47, 5222 AV, ‘s-Hertogenbosch, Netherlands Phone: +31 85 8882166 General email: contact@inmotionvr.com Chamber of Commerce (KvK): 73325163

2.2 Data Protection Officer

Privacy contact Julius Sanders, dpo@inmotionvr.com

3. Information and Data We Collect

3.1 IMVR may collect the following:

• Contact information;
• E-mail and password;
• Name;
• Phone number;
• Address information;
• Bank account number;
• Citizen service number;
• Insurance number;
• Profile information that you volunteer;
• Automatically collected data (e.g. IP Address, device OS, browser type and language);
• Mobile device identifiers such as your unique device ID, hardware type, “MAC” and “IMEI” numbers and device name;
• General location information for the purpose of providing you with the correct version of the application, and precise-geo-location information with your express consent

Application use data (e.g. skill data, billing data, your user ID, length, frequency and success of interactions with the software, or with other users, via server log files).

3.2 Aim of data registration

Our Commercial or Business Purposes for Collecting Personal Data

• Providing, Customizing and Improving the Website and/or Services
  • Providing you with the products, services or information you request;
  • Meeting or fulfilling the reason you provided the information to us;
  • Providing support and assistance for the Website and/or Services and to process transactions and orders;
  • Set up your online account and send you administrative or account-related information;
  • Improving the Website and/or Services, including testing, research, internal analytics and product development;
  • Manage your account, customer relationship management, provide support and other related services;
  • Personalizing the Website and/or Services, website content and communications based on your preferences;
  • To obtain your feedback or user experience;
  • Doing fraud protection, security and debugging;
  • To identify trends and address Service issues;
  • To maintain security and identify any server problems or other IT or network issues;
  • For other legitimate business purposes such as audits, for marketing and customer relationships, record keeping, business planning and management;
  • Carrying out other business purposes stated when collecting your Personal Data or as otherwise set forth in applicable data privacy laws.
• Marketing the Services
  • Where in accordance with your preferences, marketing and selling the Services.
• Corresponding with You
  • Responding to correspondence that we receive from you, contacting you when necessary or requested, and sending you information about Helpshift or the Services.
  • Sending emails and other communications according to your preferences or that display content that we think will interest you.
• Meeting Legal Requirements and Enforcing Legal Terms
  • Fulfilling our legal obligations under applicable law, regulation, court order or other legal process, such as preventing, detecting and investigating security incidents and potentially illegal or prohibited activities.
  • Protecting the rights, property or safety of you, Helpshift or another party.
  • Enforcing any agreements with you.
  • Resolving disputes.

We will not collect additional categories of Personal Data or use the Personal Data we collected for materially different, unrelated or incompatible purposes without providing you notice.

3.3 Legal bases for processing (GDPR Art. 6)

We only process personal data when we have a valid legal basis under the GDPR. Depending on the context, this may include:

Purpose (examples)	Legal basis
Creating an account, providing the services, fulfilling orders, delivering requested information	Performance of a contract (GDPR Art. 6(1)(b))
Customer support, service communications, improving reliability and user experience	Performance of a contract and/or legitimate interests (GDPR Art. 6(1)(b)/(f))
Security, fraud prevention, abuse detection, and maintaining availability of our services	Legitimate interests and, where applicable, legal obligation (GDPR Art. 6(1)(f)/(c))
Marketing communications (e.g., newsletters)	Consent and/or legitimate interests where permitted by law (GDPR Art. 6(1)(a)/(f)); you can opt out at any time
Analytics and usage measurement (e.g., cookies/SDKs where consent is required)	Consent where required (GDPR Art. 6(1)(a)); otherwise legitimate interests (GDPR Art. 6(1)(f))

4. Third Parties and subprocessors

4.1 Information to third parties

Your data will not be supplied to any third party without your consent without prejudice to the following. Your data may, without further consent, be supplied to third parties that are engaged by IMVR for the execution of its services, including analyzing data and customer support. Also, your data can be released to third parties as permitted or obliged by law, when IMVR believes it is appropriate to comply with the law. IMVR can share your information in connection with a merger, sale of assets, financing or acquisition of her company.

4.2 External service providers and other sites

If you are directed to a website or use an application of a third party via one of IMVR’s digital services, the conditions and privacy rules of that partner or third party apply. You are advised to read the privacy statement of this partner or third party. When accessing IMVR’s digital services through third-party social media services, your login data will be processed by IMVR in accordance with this Privacy Statement.

4.3 Subprocessors

NAME	TAX ID	ADDRESS	LOCATION OF PROCESSING	DESCRIPTION OF PROCESSING
Amazon AWS	EIN 204938068 / LU 26888617	410 Terry Avenue North, Seattle, Washington, 98109, USA / 38 Avenue John F. Kennedy, L-1855, Luxembourg	AWS Frankfurt, Germany (eu-central-1) For North- and South-America and Canada: AWS North Virginia (us-east-1)	Hosting and management of the central server, including data storage, security, and maintenance.
Google, Inc.	EIN 770493581	1600 Amphitheatre Parkway, Mountain View, CA 94043, USA	Belgium: St. Ghislain (europe-west1) — Primary EU HubGermany: Frankfurt (europe-west3) & Berlin (europe-west10)Netherlands: Eemshaven (europe-west4)Finland: Hamina (europe-north1)United Kingdom: London (europe-west2)France: Paris (europe-west9)Italy: Milan (europe-west8) & Turin (europe-west12)Spain: Madrid (europe-southwest1)Poland: Warsaw (europe-central2)Switzerland: Zurich (europe-west6)	Providing analytics services (likely Google Analytics) to track usage patterns, user behavior, and other relevant data within the Corpus VR platform.
Unity Technologies SF	EIN 264516105	30 3rd Street, San Francisco, CA 94103, USA	Primary EU Storage: Belgium (via Google Cloud) and The Netherlands (via Snowflake).	Providing analytics services related to the Unity game engine, which is used to develop Corpus VR. This may include data on performance, crashes, and other technical metrics.
Mighty Immersion Inc.	–	44 Tehama St, San Francisco, CA 94105, United States.	United States AWS	Providing cloud distribution services through ManageXR.com. ManageXR strictly limits data collection to the names and email addresses of the organization’s administrators to facilitate platform login and service notifications. Crucially, the platform does not collect personal data about end-users (e.g., students or employees using the VR/AR headsets).
SimForm LLC	–	111 North Orange Avenue, Suite 800 Orlando, FL 32801	Ahmedabad, Gujarat, India.	Providing front-end and back-end development services, including cloud migration, AWS infrastructure setup, and DevOps implementation.

And any fully owned subsidiary of inMotion VR Holding BV

4.4 Categories of recipients

Depending on the services you use and subject to appropriate safeguards, we may share personal data with the following categories of recipients:

• Hosting and infrastructure providers (e.g., cloud hosting and storage)
• Analytics and performance providers (e.g., usage analytics, crash/performance telemetry)
• Customer support and communication providers (e.g., email delivery, support tooling)
• Payment and invoicing providers (where payments are applicable)
• Device management and software distribution providers (e.g., ManageXR for managed VR headsets)
• Professional advisers (e.g., auditors, legal advisers) where necessary
• Competent authorities (regulators, courts, law enforcement) where we are legally required to do so

5 Cookies, tracking

Cookies are small text files that a website can store on your device (for example in your browser directory) when you visit the website. Cookies can help a website recognize your device, remember your preferences (such as language or login state), and understand how the website is used. In addition to cookies, we may use similar technologies such as pixels, SDKs, scripts and tags.

5.1 Why we use cookies and similar technologies

IMVR uses cookies and similar technologies for the following purposes:

1. Statistical purposes: to understand how often our website(s) are visited, where visitors come from, and which pages are viewed, so we can improve our websites and services (for example, through analytics tools such as Google Analytics where used).
2. Providing services to Users: to enable core functionality such as personal accounts, authentication, remembering settings, and handling information requests and/or orders of Products and/or Services.
3. Marketing and advertising: where applicable and permitted, to show advertisements or content that may be relevant to Users on our website(s) and/or apps, and to measure the effectiveness of campaigns.

5.2 Your choices and managing cookies

Where required by law, we ask for your consent before placing non-essential cookies (for example analytics and marketing cookies). You can also control cookies through your browser settings and can delete cookies at any time. If you choose to decline cookies, certain features of our website(s) or services may not function properly.

5.3 Google Analytics and marketing leads

Where Google Analytics is used, it helps us measure and improve how our online products and services are used. Where required by law, we will only use analytics data based on your consent. We may use aggregated insights from analytics to improve marketing and to understand interest in our Products and/or Services.

6 Telephone conversations

Telephone conversations with any of IMVR’s departments may be recorded for training and coaching purposes. The recordings are only kept for as long as strictly necessary and are not accessible to unauthorized persons.

7. Data

7.1 Servers

We primarily host and process personal data within the European Economic Area (EEA). Depending on the services used and the location of the customer or end user, certain data may also be processed on infrastructure located outside the EEA (for example in the United States), as described in our subprocessors list. If personal data is transferred from the EEA to a country that does not provide the same level of protection under EU law, we use an appropriate transfer mechanism in line with Chapter V GDPR. This means we put legally recognized safeguards in place to help ensure your data remains protected after the transfer. Examples of such safeguards include:

• an EU adequacy decision (where applicable). An adequacy decision means the European Commission has formally decided that a country ensures an adequate (essentially equivalent) level of data protection;
• participation in the EU–US Data Privacy Framework (DPF) (where applicable); and/or
• the European Commission Standard Contractual Clauses (SCCs), supplemented with additional safeguards where necessary.

You can request more information about the transfer safeguards we use by contacting us via dpo@inmotionvr.com.

7.2 Security

IMVR takes appropriate technical and organizational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to personal data. These measures include, where appropriate:

• Encryption in transit (TLS) and encryption at rest for relevant systems and backups;
• Access controls based on least privilege, and limiting access to authorized IMVR staff and approved subprocessors only where necessary to perform their tasks;
• Monitoring and logging to help detect and investigate suspicious activity and service issues;
• Security maintenance such as updates, vulnerability management and configuration hardening.

Despite these measures, no method of transmission over the internet and no method of electronic storage can be guaranteed to be 100% secure. We therefore cannot warrant absolute security of your personal data.

7.3 Incident response

IMVR has an operational incident response process to address security incidents and (where applicable) personal data breaches. While this process is continuously improved and may not be captured in a single formally validated policy document at all times, we follow consistent steps to limit impact, restore services, and meet our legal and contractual obligations. When we detect or are notified of a suspected incident (for example through monitoring, customer reports, or internal staff), we typically:

• Assess and triage: confirm the incident, determine scope, affected systems and users, and classify severity (including whether personal data may be involved).
• Contain and mitigate: take immediate measures to limit further impact, such as disabling or resetting accounts, restricting access, rotating credentials, blocking suspicious traffic, or isolating affected components.
• Remote device response (ManageXR): where VR headsets are managed by IMVR or by an authorized customer administrator, we may use remote management tooling such as ManageXR to support incident mitigation (e.g., pushing configuration changes, deploying updates, restricting usage, or remotely troubleshooting devices).
• Investigate and remediate: identify root cause, apply fixes, validate effectiveness, and implement preventive measures to reduce recurrence.
• Document and review: record key facts, actions taken, timelines, and outcomes; and perform a post-incident review to improve controls and our response process.

If an incident qualifies as a personal data breach, we will handle it in accordance with applicable data protection law, including (where required) notifying the relevant supervisory authority and/or affected individuals without undue delay.

7.4 Data access and amendment and right to object

You have the following rights, subject to conditions and limitations under applicable law:

• Right of access: obtain confirmation of whether we process your personal data and access to that data.
• Right to rectification: have inaccurate or incomplete data corrected.
• Right to erasure: request deletion of your personal data in certain cases. Please note that we may need to retain certain data where required by law (for example, where medical or healthcare-related recordkeeping obligations apply) or to establish, exercise, or defend legal claims. See also section 7.5 Retention periods.
• Right to restriction: request that we limit processing in certain cases.
• Right to data portability: receive certain personal data in a structured, commonly used format and transmit it to another controller where applicable.
• Right to object: object to processing based on legitimate interests, and object at any time to direct marketing.
• Right to withdraw consent: where we rely on consent, you can withdraw it at any time (without affecting processing carried out before withdrawal).
• Right to lodge a complaint: if you are located in the EEA/UK/Switzerland, you can file a complaint with the Dutch supervisory authority (Autoriteit Persoonsgegevens) and/or your local data protection authority. If you are located outside the EEA, you can also contact your local regulator or authority responsible for privacy/data protection (where applicable), or contact us first so we can address your concern.

To exercise your rights, you can contact us via an e-mail message to contact@inmotionvr.com or dpo@inmotionvr.com.

7.5 Retention periods

We keep personal data only for as long as necessary for the purposes described in this Privacy Statement, unless a longer retention period is required or permitted by law. Retention depends on the type of data and the context, and may be longer for certain categories of data (including medical or healthcare-related data) where specific legal retention obligations apply. As a general guideline:

• Account and profile data: retained while the account is active; if the account is closed, we delete or anonymize within a reasonable period, unless we must retain certain information for legal or operational reasons.
• Usage logs and security logs: retained for a limited period appropriate for security monitoring and troubleshooting, after which logs are deleted or anonymized.
• Billing and invoice data: retained as required by applicable accounting and tax laws.
• Support requests and correspondence: retained for as long as necessary to resolve the request and for a limited period thereafter.
• Marketing contact details: retained until you opt out; we may keep a minimal suppression record to ensure we respect your opt-out.

Where medical or healthcare-related data is processed, retention may be governed by applicable healthcare laws and professional standards (for example, statutory medical record retention periods). In such cases, we will retain the data for the period required by law and will restrict access to the extent possible. Amendment of this privacy statement IMVR reserves the right to amend this Privacy Statement. Any amendment will be published on this website. You are advised to consult this Privacy Statement regularly, so as to ensure that you are aware of the applicable Privacy Statement.