XR Usage Data Privacy Notice

How FourPlus collects and uses XR data and information

Owner	FourPlus Immersive Ltd	Version	1.1
Effective date	10th August 2026	Reviewed	10 August 2026

 

Summary. FourPlus records information about how authorised users complete XR protocols. This information is used to provide training/execution records, generate advisory scores and feedback, secure and improve the service, and improve future FourPlus tools. The data is not collected for covert surveillance and FourPlus does not permit it to be used for disciplinary action. Personal data is separated and processed through a medallion data architecture; only data that has been anonymised so that individuals are no longer identifiable is admitted to AI model-training datasets.

1. Who we are and who is responsible

FourPlus Immersive Ltd (company number 12558660), registered at Floor 16 (JQB), Centre City Tower, 7 Hill Street, Birmingham, B5 4UA, determines the purposes and essential means of the FourPlus scoring service, service security, product improvement and the preparation of anonymised datasets for FourPlus AI development. For those activities FourPlus acts as a controller.

The employer, university, college, training provider or other organisation that gives you access to the software (the “Customer”) is a controller for its user administration, training programme and its own use of training records. Where FourPlus and a Customer jointly determine a particular purpose and the essential means of processing, the parties will document a joint-controller arrangement. The contract for each deployment will state the applicable allocation.

Privacy contact: privacy@fourplus.co.uk. Data Protection Officer/privacy lead: Ivan Wall, ivan@fourplus.co.uk.

2. Information collected

• Identity and account data: name, username or user identifier, organisation, role/cohort, login and authorisation status.
• Protocol and ledger data: module/SOP and version; steps presented, started, completed, skipped, repeated or performed out of order; prompts, warnings, confirmations and corrective actions.
• Hand-tracking and spatial interaction data: positions and movements of hands within the XR environment and their interactions with virtual equipment, objects and controls. These data are used to understand task execution and are not used to identify you biometrically.
• Timing data: session date/time, start and finish, duration, per-step timing, pauses and retries.
• Voice-assist data: voice recordings made when you use voice-activated assistance, together with the resulting speech-to-text transcript or command. FourPlus retains these recordings for a defined period so that it can validate and improve speech-to-text accuracy, including performance across different accents and dialects. FourPlus does not use the recordings for speaker recognition, biometric identification, disciplinary action or covert monitoring.
• POV video: outward-facing first-person video captured from the headset showing the task being undertaken and interaction with virtual or physical equipment. The camera faces away from the wearer and does not capture the wearer’s face. The footage is used for training analysis, product improvement and, after the applicable anonymisation and governance controls, computer-vision AI development. It is not used for facial recognition, biometric identification, disciplinary action or covert monitoring.
• Assessment data: advisory score, step-level reason codes, quality/confidence indicators, errors/deviations and human-review annotations where enabled.
• Technical and security data: headset/device and application identifiers, software/schema versions, synchronisation, diagnostics, security and audit events.
• Support and feedback: support tickets, user feedback and related communications.

Not currently collected: eye-tracking data. Eye tracking is outside the current approved scope and will not be enabled until FourPlus has updated this DPIA/privacy notice and completed any additional assessment required.

No biometric or health-related processing. FourPlus does not use hand, voice, POV video or other XR data to uniquely identify a person and does not intentionally collect health information or other special-category data through this feature. The outward-facing POV camera does not record the face of the person wearing the headset.

3. How the information is collected

The XR software records approved events during an enabled training/operations session. This includes outward-facing point-of-view (POV) video showing the task and virtual or physical equipment being worked on, and voice recordings when the voice-assist function is used. The POV camera faces away from the wearer and is not intended or positioned to record the wearer’s face. Data is transmitted securely to FourPlus-hosted AWS services in the United Kingdom. A telemetry register will specify each field, purpose and retention period.

4. How we use the information

Purpose	Information	FourPlus position / proposed basis
Operate, authenticate and secure the service	Account, ledger, technical/security	Controller for necessary operational purposes; contract and/or legitimate interests as applicable.
Create a session record and advisory training score	Identity, ledger, hand/spatial interaction, timing, assessment	FourPlus determines scoring logic and service design and therefore acts as controller for the FourPlus scoring service. Customer remains controller for its training programme and use of the output. Joint controllership will be documented if the parties jointly determine the specific purpose and essential means.
Provide training feedback and identify SOP compliance and deviations	Ledger, interaction, timing, assessment	Legitimate interests in providing effective XR training and meaningful feedback, subject to necessity, fairness and human oversight.
Improve FourPlus content, usability, scoring and technical performance	Pseudonymised/minimised operational data where identity is unnecessary	Legitimate interests in R&D/product development, supported by a Product Improvement LIA.
Create anonymous datasets for AI development	Personal data during the anonymisation pipeline; anonymous Gold-layer data thereafter	Legitimate interests for the personal-data processing needed to select, minimise and anonymise data, supported by a separate AI Development/Anonymisation LIA. The model-training dataset itself contains anonymous information, not personal data.
Meet legal, security and claims requirements	Relevant account, ledger, technical and support data	Legal obligation and/or legitimate interests.

5. Training scores: advisory only

FourPlus may use rules-based and AI-assisted tools to compare a training session with the applicable SOP and produce a suggested score, deviation flag or explanation. These outputs are training/quality review aids, not disciplinary findings.

• FourPlus does not permit the ledger, score or AI output to be used for disciplinary action.
• The system is not designed or authorised for covert employee surveillance, productivity surveillance or behavioural monitoring outside the defined XR user session.
• A qualified human must remain in the loop when interpreting individual results and a responsible human must remain at the helm of any consequential training, competency, certification, progression or safety-related decision.
• A reviewer must be able to inspect the underlying ledger, understand the relevant SOP and reason codes, consider contextual information, disagree with the model and change the outcome.
• A user may challenge an inaccurate ledger entry or score and request human reconsideration.
• Where the data are incomplete or unreliable, the software should display an unscorable/low-confidence result rather than present a definitive conclusion.

6. Medallion architecture and AI development

FourPlus uses a medallion-style data architecture to progressively reduce identifiability and separate operational use from model development:

Layer	Typical content	Identity treatment	Permitted use
Bronze – controlled raw/operational ingestion	Approved session events, identity/account linkage, detailed timestamps, voice-assist event data and technical metadata	Personal data; tightly access-controlled and tenant-separated	Ingestion, validation, security, support and generation of the training record.
Silver – curated/pseudonymised analytics	Validated ledgers and derived measures with direct identifiers removed/replaced; unnecessary timestamps and metadata reduced	Pseudonymised personal data; re-identification mapping kept separately	Scoring support, quality assurance, product analytics and preparation for anonymisation.
Gold – anonymised AI dataset	Features/events needed for model development after anonymisation testing and removal/generalisation of identifiers and identifying combinations	Anonymous information: FourPlus must conclude that identification is sufficiently remote taking account of reasonably likely means	AI model training, validation and research. No personal data is intentionally supplied to the model.

FourPlus will document the anonymisation method and testing for each Gold dataset. Pseudonymisation alone is not treated as anonymisation. If a dataset cannot meet the approved anonymisation threshold, it will not be admitted to model training.

POV video may be included in the AI-development pathway where it is suitable for computer-vision training. Before Gold promotion, FourPlus will remove session/user links and check the footage for identifying content that is not needed for the model purpose. Voice recordings are retained in the operational/product-improvement environment for speech-to-text validation and are not used for speaker recognition.

7. What we do not do

• We do not sell personal data or use it for advertising.
• We do not use the training ledger or score for disciplinary action.
• We do not use the system for covert surveillance.
• We do not train AI models directly on named or pseudonymised personal training records under this design.
• We do not use hand, voice or POV video data to identify users biometrically, and the POV camera is outward-facing rather than directed at the wearer.
• We do not infer health conditions, emotions, protected characteristics or general employee productivity from XR training behaviour.
• We do not enable eye tracking under the current approved processing design.

8. Who receives information

• Authorised Customer trainers/administrators with a training/operations-related need and permissions appropriate to their role.
• Authorised FourPlus personnel and contractors for service operation, support, security, quality, product development and approved data engineering.
• Amazon Web Services and other approved subprocessors/service providers under appropriate written terms.
• Professional advisers, regulators, courts or law-enforcement bodies where disclosure is necessary and lawful.

Identifiable/pseudonymised data are not made available to FourPlus AI model-training environments. Gold-layer anonymous datasets may be used by authorised FourPlus data scientists/model developers.

9. Hosting and international data

FourPlus currently hosts the service in the United Kingdom using AWS services. The current production design does not require FourPlus to transfer UK personal data outside the UK.

FourPlus may in future receive training data from Canadian Customers for UK processing. Any Canadian deployment will be assessed separately for compliance with applicable Canadian privacy law and contractual requirements. If FourPlus later sends personal data from the UK to Canada or another country, FourPlus will assess the UK international-transfer rules before that transfer. Anonymous Gold-layer data are not personal data for UK GDPR purposes.

10. Retention

Record	Retention	End-of-period action
Identifiable session ledgers and scores	36 months after the session, or Customer-documented shorter period	Delete or irreversibly anonymise.
Account/contract administration records	Customer relationship plus 6 years	Secure deletion subject to legal holds.
Security and diagnostic logs	36 months	Secure deletion or aggregation.
Pseudonymised Silver analytics/pre-anonymisation datasets	Up to 10 years, reviewed annually	Delete, refresh or anonymise; retain only where continuing necessity is documented.
Anonymous Gold AI-development datasets	Up to 10 years, reviewed annually	Retain while useful and governed; re-test assumptions if linkage environment or data availability materially changes.
Model artefacts and evaluation records	Life of model plus 10 years	Retain accountability evidence; do not intentionally retain personal training data in model artefacts.

11. Security and access

FourPlus uses a range of active measures to ensure data security throughout the lifecycle.

• UK AWS hosting; encryption in transit and at rest.
• Customer/tenant segregation, role-based access, least privilege and multi-factor authentication for privileged access.
• Separate customer login/device allocation, identity mapping and access-control services.
• Separation between Bronze/Silver personal-data stores and Gold anonymous model-development datasets.
• Audit logging, vulnerability management, backups, recovery testing and incident procedures.
• Controlled data-engineering process with dataset lineage and approvals before promotion between medallion layers.

12. Your rights

Depending on the processing and your circumstances, you may have rights to access, correct, erase or restrict your personal data, object to processing based on legitimate interests, and request human consideration of qualifying automated decisions. These rights apply to personal data in the Bronze/Silver and other operational systems. Once information has been effectively anonymised and can no longer be linked to you, it is not possible to retrieve it as your personal data from the Gold dataset.

Contact privacy@fourplus.co.uk with your Customer/organization name and approximate session date. FourPlus will verify identity as necessary and coordinate with the Customer where responsibility sits with them.

13. Complaints and changes

Contact FourPlus first at privacy@fourplus.co.uk. You also have the right to complain to the Information Commissioner’s Office. We will update this notice before materially expanding telemetry, enabling eye tracking, changing the permitted use of scores, changing the AI data pathway or making a material international-transfer change.

14. Children and vulnerable learners

Where the software is used by children or vulnerable learners, FourPlus and the Customer will complete deployment-specific safeguarding, transparency and data-minimisation checks. Data from children will not be admitted to Gold AI datasets by default unless specifically approved, anonymisation is demonstrated and the deployment-specific legal/safeguarding assessment supports the use.

Publication checklist

• Confirm the final telemetry register, including POV video fields and the defined retention period for voice recordings used to validate speech-to-text accuracy across accents and dialects.
• Confirm Customer/FourPlus controller wording in the licence for the scoring service.
• Complete and approve both LIAs and this DPIA.
• Insert monitored privacy contact address and subprocessor link/list.
• Deploy the first-session layered notice before enabling collection.