Privacy Policy NeuroViveXR

Last updated: 05/08/2026

Reneural Technologies Limited (“Reneural”, “we”, “us”, “our”) respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, store, and share your information when you use the NeuroViveXR system (including our VR software, tablet application, and web platform).

1. Who We Are

Reneural Technologies Limited is the data controller responsible for your personal information.

  • Company number: 11988556
  • Registered office: 14 King Street, International House, Leeds, England, LS1 2HL
  • Data Protection Officer (DPO): privacy@reneural.tech

2. What Data We Collect

When you use NeuroViveXR, we may collect and process the following categories of data:

  1. Personal Identifiers
    • Examples: name, email address, NHS number, patient reference number.
    • Purpose: to create and manage user accounts and ensure therapy is linked to the correct person. We process NHS numbers solely to support accurate patient identification within NHS-funded care pathways, in accordance with NHS data standards.
  2. Health and Rehabilitation Data
    • Examples: prescribed therapy programme, session duration, scores, outcomes, clinician notes.
    • Purpose: to deliver rehabilitation exercises, track progress, and provide clinicians with insights.
  3. Technical and Device Data
    • Examples: IP address, device identifiers, headset/tablet model, operating system, crash or error logs, usage analytics.
    • Purpose: to ensure platform security, monitor system performance, and improve functionality.
  4. Communications Data
    • Examples: feedback submitted through the system, customer support messages.
    • Purpose: to provide technical and customer support and improve our services.
  5. Clinician and Organisation Data
    • Examples: clinician name, email, professional role, organisation details.
    • Purpose: to enable clinical oversight, allow therapy prescription, and manage system access within healthcare providers.

3. How We Use Your Data (Purpose and Lawful Basis)

We process your data for the following purposes, in line with the UK GDPR and Data Protection Act 2018:

  • To deliver therapy services.
  • To personalise therapy sessions and track progress.
  • To share progress with clinicians for your rehabilitation plan.
  • To ensure system functionality and security.
  • To comply with regulatory or legal requirements.
  • To improve and develop our products (using anonymised or aggregated data).

Lawful basis:

  • For personal identifiers and health and rehabilitation data → provision of healthcare (Article 9(2)(h) UK GDPR) and, where applicable, Article 6(1)(b) (performance of a contract with your healthcare provider).
  • For technical and device data (IP addresses, usage analytics, error logs) → Article 6(1)(f) (legitimate interests). We have a legitimate interest in maintaining the security, performance, and reliability of our platform. This processing does not override your interests or fundamental rights.
  • For optional feedback, communications, or research participation → Article 6(1)(a) (consent).

Providing your data is not a statutory requirement. However, certain data is necessary for us to deliver the therapy service. If you choose not to provide this information, we may not be able to provide you with access to NeuroViveXR. Technical data collection is required for the platform to operate securely; you may object to processing based on legitimate interests at any time (see Section 7).

4. How We Share Your Data

We may share your data with:

  • Healthcare professionals within your care team.
  • Your healthcare organisation (e.g. NHS Trust or private clinic).
  • Service providers (e.g. Microsoft Azure, hosting our UK servers).
  • Regulators or authorities where legally required.
  • In pilot studies or research collaborations, anonymised and aggregated data may be shared under Data Sharing Agreements.

We do not sell your personal data to third parties.

5. International Data Transfers

At present, all data is hosted within the UK using Microsoft Azure. If we transfer data outside the UK in future, we will ensure that appropriate safeguards are in place, such as UK-approved Standard Contractual Clauses or equivalent protections.

6. Data Retention

We follow NHS clinical record retention standards where data is collected as part of NHS-funded or NHS-managed care. For private care, we apply equivalent retention periods unless a different period is required by law or agreed with the provider. Technical data and support records are retained for shorter periods, usually between 12 and 24 months. Personal identifiers and health data are retained in line with NHS clinical record retention policies.

7. Your Rights

Under UK GDPR, you have the following rights over your personal data:

  • Access – to request a copy of your data.
  • Rectification – to correct inaccurate data.
  • Erasure – to request deletion, subject to legal or clinical requirements.
  • Restriction – to limit processing in certain circumstances.
  • Portability – to request transfer of your data to another provider.
  • Objection – to processing where the lawful basis is legitimate interests.
  • Withdraw consent – where we rely on your consent to process your data (for example, for optional communications or research), you have the right to withdraw that consent at any time. Withdrawal will not affect the lawfulness of any processing carried out before you withdrew consent. To withdraw consent, please email privacy@reneural.tech and we will action your request promptly.

You can exercise any of these rights by emailing: privacy@reneural.tech. We will respond within one calendar month.

8. Automated Decision-Making

We do not make any decisions about you solely by automated means that produce legal or similarly significant effects. No profiling is carried out that affects your access to therapy or clinical outcomes. Therapy recommendations within NeuroViveXR are always subject to oversight and final decision by a qualified clinician.

9. Security of Your Data

We implement technical and organisational measures to protect your information, including:

  • Encryption of data in transit and at rest.
  • Access controls with role-based permissions.
  • Secure UK-based cloud hosting (Microsoft Azure).
  • Multi-Factor Authentication (MFA) for clinicians and administrators.
  • Data minimisation and pseudonymisation for internal development purposes.
  • Audit logging of all user and admin activities.
  • Quality and safety processes aligned with ISO 13485:2016 and UKCA Class I medical device requirements.
  • Compliance with the NHS Data Security and Protection Toolkit (DSPT).

10. Breach Notification and Response

Any actual or suspected data breach will be escalated within 24 hours to the Data Protection Officer, with notification to the ICO and affected individuals within 72 hours where required under UK GDPR Article 33.

11. Children and Vulnerable Users

NeuroViveXR is designed for adults undergoing stroke rehabilitation. It should only be used with the oversight of a qualified clinician.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Significant changes will be notified within the app, on our website, or by email.

13. Contact Us

To exercise your rights, raise a concern, or contact our Data Protection Officer:

  • Email: privacy@reneural.tech
  • Post: Reneural Technologies Limited, Incubation Centre, Enterprise Hub, De Havilland Campus, Hatfield, Hertfordshire, AL10 9EU

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at www.ico.org.uk or by calling 0303 123 1113.

Scroll to Top