Security, privacy and safety
What we store, where it lives, how the headsets are managed and how to keep trainees comfortable and safe. Everything is labelled with its real status.
How to read this page
- AvailableIn the product today.
- ComingBeing built. Ask us about timing.
- PlannedOn the roadmap, not started.
Where the data lives
Training happens on the headset. Results go no further than a computer on your own network, unless you choose otherwise.
Headset
The app, scenarios and voices run offline. Each result is saved on the headset when the scenario ends.
Your fleet console
A computer at your site, on your local network. HTTPS with a pinned certificate. Dashboard, CSV and PDF export, deletion and an activity log.
Only if you switch it on
Results sent to your own LMS or learning record store, set up with your IT team during onboarding. A hosted console with a choice of hosting region is coming. Both off unless you ask for them.
Data protection in detail
- Available
Runs offline
Scenarios, voices and scoring run on the headset. No internet connection is needed to train.
- Available
Results stay on site
Scenario results are saved on the headset, or on your own fleet console on your local network. They are not sent to us.
- Available
Encrypted on the network
Headsets talk to the fleet console over HTTPS. Each headset pins the console’s certificate and uses its own token, so a stranger’s computer cannot pose as your console.
- Available
Signed content
Licences and content packs are signed by us. The console and the headset both check the signature before anything is installed.
- Available
Deletion and audit
Educators can delete single records for privacy requests. Exports, deletions and headset enrolments go into an activity log.
- Coming
Encryption at rest
The console’s records file is not encrypted by the app itself yet. Run the console on a computer with full-disk encryption (BitLocker or FileVault), which most hospital IT already requires.
- Coming
Named educator accounts and roles
Today the dashboard has one educator password. Named accounts and a read-only role are on the roadmap.
- Set up at onboarding
Send results to your learning systems
LTI 1.3 grade return to your LMS, xAPI records to your learning record store, or a SCORM package. Off unless you ask for it. We set this up with your IT team during onboarding.
- Set up at onboarding
Single sign-on
Trainees and educators sign in with Microsoft Entra ID or Google. Set up with your IT team during onboarding.
- Coming
Hosted option and hosting region
A hosted console for groups that want one dashboard across sites, with a choice of hosting region. Until then, nothing leaves your site.
Headset management
Built to fit how IT already manages devices, and to work without device management when a site has none.
How deployment works- Available
Fleet console
A small program on a Windows or Mac computer at your site. It shows every headset (online, battery, app version, what it is running), sends licences and content to all of them at once, and collects results into one dashboard with CSV and PDF export.
- Available
Locked to Firsthand
Headsets can be locked to Firsthand, so trainees go straight into the app and stay there.
- Available
Works with your MDM
Install, lock and update the app through a mobile device management (MDM) platform that supports Meta Quest, or through PICO Business Suite on PICO headsets. The fleet console does records and content, not device control.
- Available
Content updates without a tap
New scenarios, voices and fixes that ship as content packs install themselves in the lobby, never mid-scenario.
- Available
App updates
Through your MDM or PICO Business Suite they install silently. Without them, each headset asks the wearer to confirm once per update. We keep app updates to a few a year.
Accessibility and comfort
What works today, and what is still coming. If a trainee needs something not on this list, tell us.
- Available
Subtitles
A caption bar shows every spoken line, so trainees can follow without relying on audio alone.
- Available
Move without walking
“Move to” points take you to the patient’s side, the defib or the foot of the bed. “Bring the scene to me” moves the room instead of you. There is no smooth movement that can cause motion sickness.
- Available
Hands or controllers
Every scenario works with hand tracking or with controllers.
- Available
English and Indonesian
Menus, guides, scenario text, debriefs and voices.
- Coming
Seated mode
Run a scenario from a chair, with the room placed around you at seated height.
- Coming
Comfort settings
Adjustable height, text size and turning options in one place.
Motion sickness and safety guidance
Share this with every educator who runs sessions. It sits alongside the headset maker’s own health and safety warnings, which always apply.
Keep sessions short
For new users, run one scenario, then take a break. Build up over time. Whatever the experience level, take a break at least every 30 minutes, and stop at the first sign of nausea, dizziness, eye strain or headache.
Clear the play area
Set the headset boundary before each session. Allow about two by two metres per trainee, with nothing to trip on and nothing to hit: no chairs, trolleys, cables or walls within reach.
Supervise every session
An educator or observer should be in the room whenever headsets are in use. In team sessions, watch the gaps between trainees as well as the trainees themselves.
Ages 13 and over
Trainees should be 13 or older, in line with Meta’s age guidance for the headset. Always follow the current guidance for the model you use.
Photosensitivity
Virtual reality can trigger seizures in people with photosensitive epilepsy, sometimes with no history of seizures. Anyone with epilepsy or a history of seizures should talk to a doctor first. Stop straight away if anyone has twitching, altered vision or loss of awareness.
Hygiene
Use wipeable face interfaces and clean the headset between users.
Security roadmap
We do not hold security certifications yet. Here is where we are, stated plainly.
Security pack for IT
Architecture, data flows, the two network ports the console uses, and answers to the usual questionnaire questions.
On requestISO/IEC 27001
Information security management certification.
PlannedSOC 2
Independent report on security controls.
Planned
Trust questions
Does the app need internet?
No. Scenarios run on the headset. Team sessions and the fleet console use your local network, not the internet.
Do you see our trainees’ results?
No. Results stay on the headset or your own fleet console. They are not sent to us. If you want to share results for a pilot report, you export them and send them.
What does a result record contain?
The learner name or ID as entered, the scenario, start and end time, score, the scoring items and a timeline of actions, plus the headset and app version.
Are you ISO 27001 or SOC 2 certified?
Not yet. Both are planned. Until then, we can send a security pack that explains exactly how the system works, so your IT team can assess it.
Is it suitable for people prone to motion sickness?
Movement is by choosing a spot, not by gliding, which most people find comfortable. Some people still feel unwell in any headset. Keep sessions short and stop at the first sign of discomfort.
Bring your IT team to the demo
We will walk through the architecture, the network setup and the security pack, and answer their questions directly.
